3c9b97e1042687f1772b187cb8dee17eac27fc0d38386add4f6ab2d47db324e0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 5.3MB
Sample260807-txm97sstbs
SHA256 3c9b97e1042687f1772b187cb8dee17eac27fc0d38386add4f6ab2d47db324e0
MD5 24e16a8004e64258a5bf0164931814c8
SHA1 88d7aa47efaa98984e0c6d1d12f3447f5b6eb535
SHA512 ddd0679def9e98782e05d50baab90b172d7fcaf29e9c6a49ce3a0d3fc6590547bcc601eeeebac6afeab44f4aab9bfeb759b6746631cc4a95c1be842c2aad0613
SSDEEP 98304:3LXClnwPWrDSkYg5MHKO6HCD2zoJ7wRGpj3:2lnwPiQg+12zo9F9
TLSH
T13F469C13F3F541E8E06ED9B49B3956329976BC9B8B30A2DF019436211E76EC45B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
1248	elevation_service.exe
1752	maintenanceservice.exe
4480	OSE.EXE
5848	PerceptionSimulationService.exe
5148	perfhost.exe
4204	ReFsDedupSvc.exe
4380	SensorDataService.exe
3984	ssh-agent.exe
2312	AgentService.exe
5076	SearchIndexer.exe
5116	chrmstp.exe
5124	chrmstp.exe
2292	chrmstp.exe
4440	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4857beb3e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\ApproveRestart.exe	elevation_service.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1008	chrome.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df5528a8926dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000850ce3ca8926dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0f25dcb8926dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4436	chrome.exe
4436	chrome.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4436	chrome.exe
4436	chrome.exe
1248	elevation_service.exe
1248	elevation_service.exe
1248	elevation_service.exe
1248	elevation_service.exe
1248	elevation_service.exe
1248	elevation_service.exe
1248	elevation_service.exe
2452	chrome.exe
2452	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	2312	AgentService.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4204	ReFsDedupSvc.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: 33	5076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeDebugPrivilege	3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3076	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe
Token: SeCreatePagefilePrivilege	4436	chrome.exe
Token: SeShutdownPrivilege	4436	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4436	chrome.exe
4436	chrome.exe
4436	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3076	2932	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	89
PID 2932 wrote to memory of 4436	2932	2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	90
PID 4436 wrote to memory of 940	4436	chrome.exe	91
PID 4436 wrote to memory of 1008	4436	chrome.exe	95
PID 4436 wrote to memory of 5328	4436	chrome.exe	96
PID 4436 wrote to memory of 5328	4436	chrome.exe	96
PID 4436 wrote to memory of 2568	4436	chrome.exe	97
PID 4436 wrote to memory of 2568	4436	chrome.exe	97
PID 4436 wrote to memory of 1148	4436	chrome.exe	98
PID 4436 wrote to memory of 2832	4436	chrome.exe	99
PID 4436 wrote to memory of 1148	4436	chrome.exe	98
PID 4436 wrote to memory of 2832	4436	chrome.exe	99
PID 4436 wrote to memory of 4496	4436	chrome.exe	109
PID 4436 wrote to memory of 4496	4436	chrome.exe	109
PID 4436 wrote to memory of 4564	4436	chrome.exe	110
PID 4436 wrote to memory of 4564	4436	chrome.exe	110
PID 5076 wrote to memory of 5732	5076	SearchIndexer.exe	111
PID 4436 wrote to memory of 5984	4436	chrome.exe	112
PID 4436 wrote to memory of 3696	4436	chrome.exe	113
PID 4436 wrote to memory of 3696	4436	chrome.exe	113
PID 4436 wrote to memory of 3748	4436	chrome.exe	114
PID 4436 wrote to memory of 3748	4436	chrome.exe	114
PID 5076 wrote to memory of 2448	5076	SearchIndexer.exe	115
PID 4436 wrote to memory of 5116	4436	chrome.exe	116
PID 5116 wrote to memory of 5124	5116	chrmstp.exe	118
PID 5116 wrote to memory of 2292	5116	chrmstp.exe	119
PID 2292 wrote to memory of 4440	2292	chrmstp.exe	120
PID 4436 wrote to memory of 996	4436	chrome.exe	122
PID 4436 wrote to memory of 996	4436	chrome.exe	122
PID 4436 wrote to memory of 1208	4436	chrome.exe	123
PID 4436 wrote to memory of 1208	4436	chrome.exe	123
PID 4436 wrote to memory of 5652	4436	chrome.exe	125
PID 4436 wrote to memory of 5492	4436	chrome.exe	126
PID 4436 wrote to memory of 2256	4436	chrome.exe	137
PID 4436 wrote to memory of 3572	4436	chrome.exe	128
PID 4436 wrote to memory of 5652	4436	chrome.exe	125
PID 4436 wrote to memory of 5492	4436	chrome.exe	126
PID 4436 wrote to memory of 2256	4436	chrome.exe	137
PID 4436 wrote to memory of 3572	4436	chrome.exe	128
PID 4436 wrote to memory of 4172	4436	chrome.exe	130
PID 4436 wrote to memory of 4192	4436	chrome.exe	129
PID 4436 wrote to memory of 5936	4436	chrome.exe	131
PID 4436 wrote to memory of 4172	4436	chrome.exe	130
PID 4436 wrote to memory of 2692	4436	chrome.exe	132
PID 4436 wrote to memory of 4192	4436	chrome.exe	129
PID 4436 wrote to memory of 5936	4436	chrome.exe	131
PID 4436 wrote to memory of 2692	4436	chrome.exe	132
PID 4436 wrote to memory of 5712	4436	chrome.exe	133
PID 4436 wrote to memory of 5712	4436	chrome.exe	133
PID 4436 wrote to memory of 5280	4436	chrome.exe	134
PID 4436 wrote to memory of 5280	4436	chrome.exe	134
PID 5076 wrote to memory of 5084	5076	SearchIndexer.exe	135
PID 5076 wrote to memory of 1256	5076	SearchIndexer.exe	136
PID 4436 wrote to memory of 2256	4436	chrome.exe	137
PID 4436 wrote to memory of 2256	4436	chrome.exe	137
PID 4436 wrote to memory of 956	4436	chrome.exe	138
PID 4436 wrote to memory of 956	4436	chrome.exe	138
PID 4436 wrote to memory of 5204	4436	chrome.exe	139
PID 4436 wrote to memory of 5204	4436	chrome.exe	139
PID 4436 wrote to memory of 6684	4436	chrome.exe	142
PID 4436 wrote to memory of 6692	4436	chrome.exe	143
PID 4436 wrote to memory of 6700	4436	chrome.exe	144
PID 4436 wrote to memory of 2452	4436	chrome.exe	145
PID 5076 wrote to memory of 6404	5076	SearchIndexer.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-07_24e16a8004e64258a5bf0164931814c8_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x310,0x31c,0x320,0x318,0x324,0x140431148,0x140431158,0x140431168
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff86d8ec728,0x7ff86d8ec734,0x7ff86d8ec740
    3⤵
    PID:940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,781722686217475844,3957927810623089772,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4092459168050231674,5525404382191054866,262144 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,11538301244649471886,5257893114609476778,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,3092710176863945842,14580239678549522808,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:1148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,14971670592632679976,9277825929967285143,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,9381461680803030260,5419595029668469701,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,5061717227950386393,8386821105148019055,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,9884028724910957771,1589938639580541561,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5736,i,9884051767322365555,6597424964695314167,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5748,i,3887243953496728071,5667743594765164987,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e4,0x2e8,0x2b0,0x2e0,0x2ec,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5124
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6044,i,2139692975640372206,5081491117749099963,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5740,i,16807268632506864585,4013721395592362309,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5804,i,8510838368820966010,13962680484521959632,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5944,i,11019540411455492552,12226874560856070868,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13789256323006779171,1953759170962048869,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:2256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,5323444838149629490,6588506794779583763,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:3572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5828,i,4813694325364079821,10429966221325058002,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,10789310173797467552,6964305341310227669,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,13598989215804636992,1690005428755326963,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6356,i,17622208581840118277,13322799361836028449,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,1803615990405956806,12487806249556695775,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:5712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,14201956325213655829,15175203798395061731,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4692,i,13157917891979844128,12097695971852168885,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
    3⤵
    PID:2256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4900,i,12481178465061344795,15297046725435590164,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5552,i,5351955445727080654,1876525592050674215,2097152 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:9
    3⤵
    PID:5204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,16729965031723106895,1165462684049010977,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
    3⤵
    PID:6684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,17186858272266921650,11792974611584270516,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:6692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,8432331426365530449,13389747853522908512,524288 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:6700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5944,i,14621902002419697135,3941298048999682540,262144 --field-trial-handle=1896,i,14226442504139416998,12303078714226752406,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2f40ebb55e15668103bb41d623406ca631ca0ab1d799f963fd138faae2adc85b
MD5 4eeeefe0a4d0bfbf99409bbc1ef3f3e8
SHA1 72a1d6372eff875345f83ba8ea57093db709c898
SHA512 45fce11384fffa84589791195e97e163e160b67aecc7cfc7f94a25f667952f4def525227a2aaee817a6afe38766f9be5deb072a6f028bbace00ea1e90d4085af
SSDEEP 49152:bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnOLNiXicJFFRGNzj3:p3q6mjB57wRGpj3
TLSH
T1B2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 290cc6ded319748fb25d733a743b8ae3af9d697c5b707fdf8a6af4feb4cc9e15
MD5 afc2fdd32229cef6a81da4938ed65566
SHA1 662cdbaa140e2be082ceb2725ea066ce853aa636
SHA512 bc758548de8f82c0dcc081367fe3c46750042505cf3722defd33e0113d34089913fbd66fdf252f4b739316d4134aa16eb47224ddf5d8ad366d87f16f45dfdeca
SSDEEP 24576:2XYfDtczAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1tcQLNiXicJFFRGNzj3
TLSH
T1CA75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a49646acc254d833e70e9aedcdcacfbac36fd8907e1ec5b65ad58907c1da76d2
MD5 0dbb9319ccc41b9974319e623900b6f2
SHA1 181de11af0bdb951c8b5a0937b9b52ed803397fb
SHA512 b728bf9b4df90287447290d6f6e059f70829e8e0c8e8129abbf078b421b37fcbcc7a002d08f3eef5bf5e74948f5f07d64321a7096d1f2e3925f6477f5a37766a
SSDEEP 24576:q0Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qPji0Az7LNiXicJFFRGNzj3
TLSH
T167859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e3602b6ba1092d76ef4caba39df63b61a3b0f04a2dba223d172c1618b8f00416
MD5 3cefa2eb0dca9afd72a294dbac6a210c
SHA1 cdd360f1ba85c6de75f827099993a0633f16eeff
SHA512 aecc5726138895d02eb8fa5be868ba50533eefa5418ea0a934d7dc34bb6a092316bc596224b1a6fc16eb5b3886d1ecf99ea2cd5da7c4c30c2a4c035abd9bfd5e
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWj6q8wyuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8/ezSC6vUzPv+HjyPLNiXicJFFRGNzj3
TLSH
T13A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a69a584da48bdf05d93f48a4096e3ab0fb868f99723c69c627e83534490258a
MD5 ef496a52b2367cd5b9a1dcd68447b424
SHA1 0c877977d6799b8a0eb479bc8b4eb3966478d1ad
SHA512 18b02ba773ee30190e4779d6481dada5d15bbc72fbe44b70521af814fd7fb14136e7d5baa6453db2f0d5ac99fed1485c80e7c23d523349b7e0b1e99189214492
SSDEEP 24576:AVbqPb88hv/l+Bp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVO88hXl+bLNiXicJFFRGNzj3
TLSH
T1E5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7642450e90fba1ac54e78afe2079860ee61b3138c448ba0730b963cc6e4c050d
MD5 25b9e811212a1ffb62126eafd069cb81
SHA1 e096ef304a73a6e0e268b8b2fbdbcf8dcff08dfa
SHA512 922e5ca748696ae8562638d832a5178e03a18442f0305765e67f0fea7447ec527c6ac04263df6b4030806a100ae572754d23355b73b10df919391454e9c3bc49
SSDEEP 24576:rGi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vLNiXicJFFRGNzj3
TLSH
T1535523D3468864B1FBFD003A867A5828B5845E2CCA595DE2D2503E5E913CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e14b04e28798e6bf1e0c2774c70a4d9897dfa9304011708be481915dc1249c34
MD5 c397e468175271a04dcb9c87ad5e41de
SHA1 2cf26514eb1f20ce72e91b489d17fa6cb1223c06
SHA512 05dc671714488f39a4f65ca701ad840f9c1a0779031735e4ba03893c3284a9ddbf55b120d0d1791a9d4360aa80d3e18132d2d8a7b3b66db4510cb7ecf313e719
SSDEEP 24576:rwuROWv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rwSOILNiXicJFFRGNzj3
TLSH
T1BF65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 904b063888be3902ac8ced2916b339616b3bdbcf68bd2ee1d2aba984259987ba
MD5 93893b4a62c22c24f8e627e4d98cc717
SHA1 59843741190b3168f35ef55387440e417ac74d9f
SHA512 40ca8db867c55e5ee30940b7f55b4c3b63cc5a396fd84b07508f8a4aa803ff1a74a3f1f58c21c19369eb78def5f9b3cfc2dad2f72cf1f687c7c1488afd3a6f2b
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3l7wRGpj3:YQyiKanX+PNJF9
TLSH
T13B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.4MB
SHA256 3bbf206b7ee9280f48f6bc9fc3e75eb2c6b6699789fe2c98a228cb0554b4c535
MD5 58662ded1cb69c189cc41b538cc19671
SHA1 78b948f7249c8f7d9a38270d0ffccca462a2d0fc
SHA512 2ac0983653d546cf542ea57e18e1f91e1b02845af10f4f8be0b25bffd1849a4ef32c53e324fa531b887df8b134b246a9f9840b8d7e2371fac6ac044c4035538e
SSDEEP 49152:aB+taZ3usBWOBr4tEGN0bqx0z+n217aau1glKLNiXicJFFRGNzj38LNiXicJFFRI:Iu6Jmrxd2dK7wRGpj387wRGpj3
TLSH
T16DF5BF13F1D901E8D06ED078874A9233FA62BC490B35B6EF0A9077562A77EE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 73898ae747036ba4dbdff8c6f11147e399e2ed0797f85cca1909265ffdde9857
MD5 c2eb7cdd60238edda5a4100ffffb2cde
SHA1 1057beb96d98b69b221df80251168d83c40b1afa
SHA512 de2d24a7fe64d9540444ef9efd14d9d9999ddb794b12f16e8452f4a7bf4023f338f8bc49d14998a762188cb1c60b7ca2e7445c7c610e714fa9b1e126b4082adf
SSDEEP 49152:nB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glKLNiXicJFFRGNzj3:pu6Jm0xd2dK7wRGpj3
TLSH
T17FD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2292_13430593601564900.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2292_13430593601564900.pma
Size 696B
SHA256 b31d639c6bdc519e6b75ad09090d482d6595156277e9e3776915a7a2d29a9072
MD5 048692921f1bc4c9e964e99915ea820b
SHA1 29193ffd7afa7a7d89ca69f4103b57b0cbf5927b
SHA512 c0ecef20afb168d3298945861204957e0e6fdca33399003598ef789807b8c8de1142274d61ba07244cdafb9515a646eb3de7cd17a4d15d7185f275fe6a06d085
TLSH
T1C601C946A3144F67CC428D3584FE27512BB0FA501B821BBF7B50724F2E021C8AE99168
MD5 SHA1 SHA512 TLSH

Submit Download

5116_13430593601741500.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5116_13430593601741500.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a554d5f06616abab33357b01948ededd2524a9cf951673b4998ad600e9dfc97b
MD5 4b4882e0435f412245618ce7c7f18ab6
SHA1 eb72e361c53439f6fdc0b61023d701f938dc42e9
SHA512 793df8e9c51fd62abe37250352dd467ee373acf25fbe094eec3e64e903c40cecc503e9157dfb01b78cabe4bbecbab530135ab21901172869be359378a13ce30d
SSDEEP 24576:Jfwvzk9RX6wkyAIC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oMnYICLNiXicJFFRGNzj3
TLSH
T12385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 26a83aa177a964dc3d59118744742f5b379a7a23011e3cc3eb4f038a11e1ad61
MD5 2c371857c5a4f6a67e6d7e41eb4c93c1
SHA1 986b4e37ba887a0940d3dfd723202db80619f3b2
SHA512 c1b9227365cc7990951944b2b25afd1030885e547abaf63d872e147228840db60309795227cc352cc28f584c4657f845fd1d38f0f3daf9328cbbeb159107d0aa
SSDEEP 49152:tYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09LNiXicJFFRGN:cySzPF7wRGpj3
TLSH
T10C066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a83dd23b8fda135ad80955ddd4818c64bab10f908a81ac1530e9f933cbeb59c1
MD5 1599527160e7a245f118c78d97fd1d10
SHA1 93d363fc6ebe0d6da8c36bfce3aa82abf8977fa5
SHA512 13f7471de35a1879f3ce219c2c8b71c307274ab99b0422d08db8fb7c700f87b28d45ae45b5b76da9e1b3af285e14c88e400c31d0bbaa22c036f5496c1cddc215
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n47JUQjqirIhCnDHUPfF/tLNiXicJFFS
TLSH
T1E365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 8e21b38bcfeaa51e203b9b3c2afc7c5c4700ab26a2b569eceb5bb59ef82d4ee0
MD5 57151e99dbffd89a88bb80b0e85fcc34
SHA1 942a0ff5dd03f9370cf015d874e1bd5e7b87c329
SHA512 38c47a93049cc37334e430f283fcf97b0f879ef5eaa243fc05a10e2fe3c575da46aa394bac0ef77ad544aea10b05ea0c0f8a87f0444b76cc241a4725893e87a1
SSDEEP 12288:k44F+7U3fwEED7QhDHKELSR0Rz6DLY5tNywIO0oo1V:k4GsUPMYS89ywIR7
TLSH
T135253810B66AD75FC5AD80321E33C1CCAB707D41EE059B0772C8972FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3604d72aa93736aa7d873565d7d28f495c78dd208bb4176034d466642c48846e
MD5 120483205f96828a484fb68fc9394c82
SHA1 d2512acadbca306c1a98af0da476f1f85f2a4522
SHA512 8b119bd13b41b61619b653bd652826ca1b9aae06b94959b358b5f266295edabc0025ee8ee781ddc09bb4f4b9137669f66f05c4d5e1ba75b646e5afe7946f569b
SSDEEP 24576:FkJuh/ke39q0FhBPJAFbjoBPGZ5LaosAAAneLN+2VA1UC:FE4p3syhBPJAFbjoBPGZ5LaosAAAeR+H
TLSH
T19555C681A537A3CFD1FB6032076A5B4CA764EC0773095F26B384453ED81AB66A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f0ffa0ddfde7b3e5a5310a12f2196bb47b9cdd9ac0acd8b3382c442fa84d5a88
MD5 389a185f9046b3510f2369b739678889
SHA1 4c8d2213cf38d71142d82fecb3fef3ea2e385c9e
SHA512 010cf6af38440a96deb00da0eb76f3e05b06b53efc7697a0c19837f48cec3c4e92be885cfcb5686530dc6cd05ace2711b2b8adeaf76fe603956be6f1c9cebd22
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35018e6a83bf780bc74a28d57068f1303a777cfd2c09904b9fa6e9bac35b9bcb
MD5 3a4bcd097a2def704498183ae3fefb99
SHA1 6b72c131571bbad80e5f03e45dc1f2a39370ed8e
SHA512 ad61610557ae994130cdbad6b72966299cdcae306554f1068582b9de55715a3dd0c8bef4862c2a5f1ad8a701f763f98706a6753f10fc0241d57d31268c1f89dc
TLSH
T187319CF7C3D4997D890456F8AB157F1ACE290E18531C3C26C9D8AE1F57E6872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d71a00abb7d6288be72a6207400b42771c7c10393a130a2aac69819caee20a01
MD5 eccda80b2e823c31de1f7465e638ddda
SHA1 f27b8a564e21e8f34727655d3b91d859afcbb3f9
SHA512 60bb1be313443fe71039adc0ad4d5650cd215a849899977e84ea79698e776855cb00ee9b0a470a69da260f9fdc5273a501df7a6d87914bd0208610fef5d00cb7
TLSH
T152517DB3C3D4867D881196F49B256E1BCE3E0A28521C3C66C9D4AE4B57E2872D21074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3667fe99d775d9e08d54b5d62710137629372d3d4d5cd34b8c31093bdf868c8c
MD5 8c5e9bc90143e2f0716e0f9ece4fb0b9
SHA1 63c2aafaa04f23ecab84852c9bae8aadc3d9fcf8
SHA512 1bbba4ccfe8cb1f4f4efc270f17ee1e38c6ea423777f3deb013e51714ca044f081734c0d126fb9c69113571dcc80ca4270a1c82765684f07433457e83792f5c2
SSDEEP 192:fRHCg8eAbv7AvAPRp2zqXsb+WNnec2068DfaQAiyIsnAUgR:fRiIAjc6XpXwx20BaUR
TLSH
T1CB32C46DB914797B9DCBC22AFA257753E6F5107130943E84E6FC952C14E7ACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7a53bf171077bfd23877a7d0fa8f24e39c297eefa5431a48e663a2ca53a10dd9
MD5 5df205d438d1b9c85aea9c1338af73da
SHA1 82aeb310bcea19b9825ead7ea3fd0443ebd8a652
SHA512 9ce5876206786dbe7b67b03f86c5af780949be9373b1a95053e3e629e37f824efa09206cc485ab52e77c966284aca7c0ed5e9c92335a9913f7d03d321acbb096
SSDEEP 192:fRHCg8eIZWbbv7ApAPRp2zqXsb+WNnec2068DfaQAiyIsnAUge:fRiIOUjcUXpXwx20BaUe
TLSH
T16332C46DB914797B9DCBC32AFA267753E7F5106520843E84EAFC952C14EB9CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5986ca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5986ca.TMP
Size 3KB
SHA256 ddc799161ff29e588a051646b7190e54a6217c31ed44b726feac0c9c275ff00e
MD5 ec4ead849493f323cc44784e02ecaf99
SHA1 819af365c464396e3d1a58f7c390bc5ad6d41789
SHA512 9e5b66f67139d935e0ba92db788297ffae8864b992e0a24f0bed16adcbb61e514b74e792c99fbaad0bef3c9f14bfd328a7b81adb53f126aab223d4475175fd10
TLSH
T1A861616DD1704CBB0DF23B64B43E0B83FA91463B1544281A797E4A8C5FF99AB4190FA6
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 260da34dd62dbc1aff331282f2e0c5adffea05985b2c287dc615b163e247bed2
MD5 b9af3c5c63389abacbc863942437d5dc
SHA1 a9bc7e6b3d2b1f976cf942bcb291c6f45e215c79
SHA512 f60e18ce52e7d5bc6be3870a143fd66da849bfa51965a2d101e4208d54c15d665fb9e50981f5e8285c10204ec719bf9376ea048e8c0adcfa82cdbba78f7dda0f
TLSH
T1D3B01214C0571740ED4081B0110D508936A05E31A0400B0393F4ADE6DC434E04267254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5de339c47331daa4d8f2f49f893bbbc7c309fdcc2cd0c3a6b23fabea7ffbfb93
MD5 ba3274ce1cc9fcc58dd37b637d934ff5
SHA1 69565aa0f65122e03dfabe7dcd99b683b804a11c
SHA512 0070a90c6e9c65d4cd011adf3e50a1a5d53093eab5188e92ad157cda703e9d30e26b462581a74071f28f13580eff6adaa7c7240a93787bb397f1c537e59e2427
TLSH
T1DFA0021056C11825CD5156F1A971454E779548367D61C30757D5385598FB1C84D036F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1352519ea2b680348635c135609d479790764fe74002a5c0dcf6066bdc006430
MD5 5d7a9b53ae9296d230e0bde27afb704a
SHA1 93865fb64a35c71853f4ca059914f7a14b62f504
SHA512 88c59edbb47d3904ac819e6259576c0b4961f60b4236a6c9d1dda75a8e6c6ce71cd1f50079b78b1177bafebfd33ddfcbd2b226d734423112d103ec88ce5e5467
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 47726f95f564af1e999778b5d9f290d8f365f89aa5f8789bb656da0437ebaaed
MD5 c9ce66b4ae6871515bc029b19fe689fc
SHA1 7a6e53f2a51264f370cabd2e0921d8b3ecc6a1ba
SHA512 8655452950c38a585172f0fa88e5a1726f6c29ea0344799626566f5fcc9637dd8617dfe328ece1685d292e6aebf229726e76f9c5bac2007cbc6a391f95e97d93
SSDEEP 3072:kuCKkl4HFJajJb1oB4X8VhXccaYCFs55MLLKH:kuCT8FulmB4XQhsTYCFeSXe
TLSH
T1F7C3123456B34BABA533D215061AE90ABEE82153C9E93E75FDCB7F0428E291C7364934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2db128186c0c744bb09131f97f8e63d0181b4efe2195a5c03179a656ff470496
MD5 faf08199c0932e54f358e69fe0aeba50
SHA1 71fccb0dbd651a93ff6e61ccc133f319d9938c57
SHA512 15753aff84b1dbcb95b0dec0c4663ffc69909979f21df9a3296ab6b63092f865efcb6e7e8a00b9c2401e397071edb799efbe6acf446fdb7eeb8c7d1a54d46879
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5/CDjB6/dGyv95SFhbb2Jv4a:gC0LA/TE57cDUD89UweSFhbKl
TLSH
T132A1F8B1B4695EB75DB5C545F9827E83DF68A157A9217E80D8DC1F0C10E70E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 47f823b22040a540115accb03cf236534684d96d6f86b493b95b0db55fa8d3e2
MD5 49e403ea1933f8b417f3e66e0e4b979f
SHA1 0029910e68c5d6c94481bcfef313045ceab81d79
SHA512 2a1cb2e897cf8d8675a52b7b04aed9defb3da1cd0671d48ff445da818e9ca2e313537203126ca73e7ce1166e643448310d6bfab5258190aba9d37d30b7d62eb3
SSDEEP 3072:muCKkl4HFJajJb1oB4X8VhXccaYCFs55MLLKH:muCT8FulmB4XQhsTYCFeSXe
TLSH
T1EEC312344BB30BAAA163D2254A5EE90EBBD81057C5E52E75FDC7BF0428E291C3364D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 dc59b15a995ee316361180d5fe04dcd0721efc238cc6e332c46f236a40d673ba
MD5 ecc96f4745db07af2f8b9daa04ea6a8f
SHA1 bd4c2a3ec7661c57967c3d1327b43998b7ac073f
SHA512 23ffb80341c4febcc78698a349b6011ee6c0f56201fc202d288f66a97ab8f755e8ba764c21075b531a7cb736eceaf10d1e9c80129ea265c87244dd8fb090a315
SSDEEP 96:CC6yd+cAOIt5aDVmufj76ccSl8h4otop5/pDjB6TJGyv9JtFiO0AuSwKhSDFX0j9:CCJLA/TE57CiU2h9d+tFGSwqSDFXUZvt
TLSH
T1FEC14AB0B8BD6EB65EF6D544F5427A43CEB4A157A962BE9489ED4F0C01C34DC2343A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4436_1772602056\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

4857beb3e05f6396.bin

Path C:\Users\Admin\AppData\Roaming\4857beb3e05f6396.bin
Size 12KB
SHA256 0bac487768a635b019649860f84d6d6edc4e7fb8385f7aca112ffa1d89c28098
MD5 fff229532bc488c2499623880f71f396
SHA1 59ff4ea9e40c96798819aabf39a712f3b48bbea4
SHA512 fe519a9638281329d94f1a32448cb3499c73ababc1e525128dc1cd99781bc3db7580809b9cf6375ddf0ed7823186788bd5473b41bf2878e4fd3284076130945a
SSDEEP 192:lYzbEWP4s89isW2vEGh5hLRybRv4Ny7LTPW8U9iiI6+7v3MZtSSiD1l7H1/JGhb5:CXEcwPWQhfsHfzHUMLCPiPZIQVq
TLSH
T15C42BFACD26BBBD5E2348CC205ED275B3F63C4FBD9CFDE296E5D0410492A6B4721A108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 83fa4a076a1f1b286a0c4914349b3d11ebcfbeb621bc40546c72cf366c6bfa70
MD5 957507b571153c9088341c9f815faf06
SHA1 e1f50217dbaf2a572d0ad2f74c192a1fe9908198
SHA512 15ae7eb9a0836c117d67c38a0d46272c5dff91072bdbe3aaf5a7260f32a7aa61f26e95be8a6d1577cc7841a6c2f5f30576d13cd5111d6ea2f3ea3adbec829236
SSDEEP 12288:5F7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D9552393568859B1FAFD1039867A8434B54C7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0171915382c0af8746bd664d689c63ce72822eda42496c99d2abe6222c3133b2
MD5 473efd414ff45cfef7193017d72e9c1d
SHA1 ad7cd0cf2a58ffeb99995b14f6ab77128996710a
SHA512 24971de38d8c174242ea8a2d43944859f96a7eae7b605d3f20f97387355147de65e783e594c7b2ce633a9deff91927ab02e5d03acff5623b845971c01ee6ad62
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Egb4mBIBhGF3LNiXicJFFRGNzj3
TLSH
T18165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4c1b98350b4c9f26b15cd07ad2f4bbc3b0b93980d51944cf56f08ce71d63c3ab
MD5 df77cfa5fc66665a97aeed1dac5529b5
SHA1 e8b3092d89cc330b20b4caa2b698d865d3088ace
SHA512 b31d0bedbc21ff2e4efa49b3370911a1fbb2bcc6f909994a5aa5ee20d74ebe2eebe6e17366eb77cb9e77d26e64fffdcfd8ed0b814986950e765321f175e5b8e2
SSDEEP 24576:QG88u8FpJqH1vzria7/mH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D7ZFPqVya7/4LNiXicJFFRGNzj3
TLSH
T16285F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e8e1d521d9a5b540f473b45febcde68e87d79907f918f08940c6d069994d035b
MD5 8eb2eb5701641eedd852c352c5f555f5
SHA1 3e84b71d27a0490f45d35eb335a32394db7351e4
SHA512 13b09675bcf4169ca70a09d9ebd41385183502f9aa36cd9051ed17a198486442992ba010731844be7e45b9968d98f8c7b07a26790197c8af03c34220c7317fe2
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTLNiXicJFFRGNzj3:9G05lO43b67wRGpj3
TLSH
T1F3D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 567876291a69be5ddf2b1a6965a24238751c12f4c051c2748d9e69115813d201
MD5 24e2eae90de092fc8deb715067676789
SHA1 06140b634959a81330c77288a69c188e79e64ef4
SHA512 294566cb660314f41a5d096223e5f11f87a20c7b467975948b7fc5f5dc52da6f795e12d7b30edbfc4a89621c1b9e92c06567413937b52636144908cf22264ce2
SSDEEP 24576:mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn9/TwSfVcYG3K/cJHlnFR+IGNe8jg:+a5POZ3lJt2pasx2+m7LNiXicJFFRGNf
TLSH
T16D65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d6f1d399e030a5ef4c85b001ea694ca0b74293009aac0ca4acf88ca0cb63e85b
MD5 692a4e9908137d98dfdc964213ae0bb4
SHA1 d37eef97984823f6c4b5243115251cd6e3570248
SHA512 b0e1e8a7659c107cff013f19b480a49d260831943e4a7b772a6256299dd26467adaae793ab3c26b03677323f2fc6b2ac91d3d7da9e074a28ef7322dba1a9ec8d
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Nc/zEOVHFYLNiXicJFFRGNzj3
TLSH
T146858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 7aba77e72509d6ae15d540768c9c7597bc97b34dfbe9f0382574e247c4bf0b65
MD5 3125993c363a5dbaf01c34e609522245
SHA1 a74702344396b6621e6c2d2853f9e31bc65efbd2
SHA512 971c0b3126c257e95e8a9aa67a8c9e43904832a7afbe54302bd4d6856e49194358df032c3c29b55ca4c8d11fc43c6b912406a0447c60e5ad05a28e5e1c7e7002
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 ba7e71eb8d2aa4298b574f463ca9a8bb7bed6a54d03c934b4a79a5406c2689cc
MD5 4269c6c7601e0683a35e3d9f6e708fc1
SHA1 ce943929dd91804491db9a396020230d77d745ce
SHA512 6261cb09a9eb8a943f964b2f2babd2981bb6f2f4eeac4558487dcd58b786cb13f355b96b75cd9cc7e16507da1c21a51dc54354e42c3cbfc3586d3aaa7ca25df9
SSDEEP 96:5a5glzJnEEk7a8AhK2oK2hNkQjsmy4BzeSghK3sK3x60:05aBED2OjzyTHcz
TLSH
T1A2D16E96CE0248FF3AC29F7B334332565E6B640AC7D4657277DF9206F0CA564052F1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6fae4efc84a23ce829bacbc5d408e1628a46ce75fd0677f0ae1681f6bd979ac3
MD5 bd2e878fa8c00e2e2ef1f95bd4fecfda
SHA1 86748e64c537a130e398c797b97f9ad37e288d3f
SHA512 fa9406eb850957b1f6fbc77ff39391b0b9f22be95c79ad15f83ebcd728af2abbc46c206631810970be578f1fcc1285af7ac0c2497c2b0d7ae4569070ed67a8fd
SSDEEP 24576:CzkNvNnaFeYhJNtmZBmm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CzMwBtOmmLNiXicJFFRGNzj3
TLSH
T15355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2ef49669270b78d560d3c6f0be4d827245c3339a9c780a2e8e15be78f9f77305
MD5 4e29643c4b530d3d806aa3fd4ee9f660
SHA1 aee1e21b5771ce50238090a90f627671a1428911
SHA512 7dd0bbe4400eb71e774ae91864cf44ad550b2c0c6a8f61a70cfaf5d5fc5396a697173a1052fccb88e9f9bb28a5d693a8525421de5bdaef565276739717cf1bb0
SSDEEP 24576:QPUr+NQD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJQDLNiXicJFFRGNzj3
TLSH
T1BF65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a17e5b710670c048cecc47709ff467820cfbbcf97b306e63e76cc396d5af649b
MD5 ff651662c54efef9078639470a2b839c
SHA1 0d19b6970277c5176a149e291784085a9def3f7a
SHA512 cd142023f36f37b68bb31396a1b5e55da29dce38182f3ea71986144c608ebcd3d8dac0840412e24863fc468edd62a36389fc844200a4ee92846635a737c263f4
SSDEEP 24576:cD3FHshBIYQgAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cDVHeBIAAqLNiXicJFFRGNzj3
TLSH
T10875E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1248-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1248-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1248-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1248-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1752-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1752-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1752-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1752-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1752-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2292-448-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2292-443-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2292-466-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2292-437-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2312-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2312-150-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2312-158-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2312-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2312-156-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2932-30-0x0000000140000000-0x0000000140561000-memory.dmp

Download

memory/2932-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2932-23-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2932-0-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2932-6-0x0000000140000000-0x0000000140561000-memory.dmp

Download

memory/2932-8-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/3076-13-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/3076-21-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/3076-11-0x0000000140000000-0x0000000140561000-memory.dmp

Download

memory/3076-136-0x0000000140000000-0x0000000140561000-memory.dmp

Download

memory/3984-139-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3984-396-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3984-137-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3984-145-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4204-1193-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-113-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4204-1191-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4204-119-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4204-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4380-124-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-398-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4380-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4380-378-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-125-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4440-465-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4440-1180-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4440-449-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4440-455-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4480-79-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4480-80-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4480-239-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4480-86-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5076-424-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5076-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5076-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5076-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5116-417-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5116-411-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5116-472-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5116-418-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5124-1153-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5124-425-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5124-433-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5124-431-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5148-316-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5148-103-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5148-108-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5148-102-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5848-306-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5848-92-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5848-98-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5848-90-0x0000000140000000-0x0000000140222000-memory.dmp

Download