3e1a5a72202e2c1bdf52d6d73624770890a7fc32576b964232dc9633989834ea

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.8MB
Sample260819-e1nb2sdm9s
SHA256 3e1a5a72202e2c1bdf52d6d73624770890a7fc32576b964232dc9633989834ea
MD5 c73f6cf72d14c51685dc8c7851bedd95
SHA1 4ce7b67274700259f4b969ce54e20ebb6d0d3728
SHA512 cf0c0fe09aad3b752000a0a1eebfe973fbf5104f27560490b1b79216115f66d5c27363ce133c01e1378daf12fed812231c37ebf248fea7494005c45cdeafdcaf
SSDEEP 98304:efxRAlbJAVh23VCxZGhi15UUIT5NW7wRGpj3:Ox4eh234wk15c5AF9
TLSH
T196867C13F2A501E8D05ED9B4CF3A56329B357C4A4BB092EF269436E11A75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
1820	alg.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
1080	fxssvc.exe
3980	elevation_service.exe
3368	elevation_service.exe
3404	maintenanceservice.exe
2868	msdtc.exe
4980	OSE.EXE
884	PerceptionSimulationService.exe
3260	perfhost.exe
4256	locator.exe
3244	SensorDataService.exe
2700	snmptrap.exe
2388	spectrum.exe
4680	ssh-agent.exe
892	TieringEngineService.exe
3880	AgentService.exe
2944	vds.exe
1476	vssvc.exe
3756	wbengine.exe
3448	WmiApSrv.exe
3376	SearchIndexer.exe
5444	chrmstp.exe
5520	chrmstp.exe
4180	chrmstp.exe
3240	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87dafd132d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4084	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f3284b1922fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff3198b0922fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d969eb1922fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052c08fb0922fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb4075b1922fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d713b1922fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf60feb0922fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000714127b1922fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d98f9b0922fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1952	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3988	chrome.exe
3988	chrome.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
4964	DiagnosticsHub.StandardCollector.Service.exe
1052	chrome.exe
1052	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2964	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	1080	fxssvc.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeRestorePrivilege	892	TieringEngineService.exe
Token: SeManageVolumePrivilege	892	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3880	AgentService.exe
Token: SeBackupPrivilege	1476	vssvc.exe
Token: SeRestorePrivilege	1476	vssvc.exe
Token: SeAuditPrivilege	1476	vssvc.exe
Token: SeBackupPrivilege	3756	wbengine.exe
Token: SeRestorePrivilege	3756	wbengine.exe
Token: SeSecurityPrivilege	3756	wbengine.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: 33	3376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3376	SearchIndexer.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe
Token: SeCreatePagefilePrivilege	3988	chrome.exe
Token: SeShutdownPrivilege	3988	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3988	chrome.exe
3988	chrome.exe
3988	chrome.exe
4180	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1952	2964	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 2964 wrote to memory of 3988	2964	2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 3988 wrote to memory of 1888	3988	chrome.exe	88
PID 3988 wrote to memory of 4084	3988	chrome.exe	94
PID 3988 wrote to memory of 4536	3988	chrome.exe	95
PID 3988 wrote to memory of 2512	3988	chrome.exe	96
PID 3988 wrote to memory of 4536	3988	chrome.exe	95
PID 3988 wrote to memory of 2512	3988	chrome.exe	96
PID 3988 wrote to memory of 3724	3988	chrome.exe	98
PID 3988 wrote to memory of 3932	3988	chrome.exe	99
PID 3988 wrote to memory of 3724	3988	chrome.exe	98
PID 3988 wrote to memory of 3932	3988	chrome.exe	99
PID 3988 wrote to memory of 1680	3988	chrome.exe	101
PID 3988 wrote to memory of 1680	3988	chrome.exe	101
PID 3988 wrote to memory of 5724	3988	chrome.exe	120
PID 3988 wrote to memory of 5724	3988	chrome.exe	120
PID 3376 wrote to memory of 1268	3376	SearchIndexer.exe	122
PID 3376 wrote to memory of 5204	3376	SearchIndexer.exe	123
PID 3988 wrote to memory of 5360	3988	chrome.exe	125
PID 3988 wrote to memory of 5444	3988	chrome.exe	126
PID 5444 wrote to memory of 5520	5444	chrmstp.exe	128
PID 5444 wrote to memory of 4180	5444	chrmstp.exe	129
PID 4180 wrote to memory of 3240	4180	chrmstp.exe	130
PID 3988 wrote to memory of 6048	3988	chrome.exe	139
PID 3988 wrote to memory of 3752	3988	chrome.exe	140
PID 3988 wrote to memory of 4564	3988	chrome.exe	141
PID 3988 wrote to memory of 1052	3988	chrome.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-19_c73f6cf72d14c51685dc8c7851bedd95_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.138 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2d0,0x28c,0x2d4,0x288,0x2d8,0x1406b6708,0x1406b6718,0x1406b6728
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4d0ac728,0x7fff4d0ac734,0x7fff4d0ac740
    3⤵
    PID:1888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,12822848870475342438,7874847194635875297,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2652 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,11635362887712140115,9039236403479265814,262144 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,9490961386605596791,8700397156144190395,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,12688184801883055831,16664446768291433785,2097152 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,8941924914340169670,526769134211742732,2097152 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,9654894641496345702,7624266311633846270,2097152 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3896 /prefetch:2
    3⤵
    PID:1680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,14931962043433662999,17984049967823644612,2097152 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,17240040158111251015,4413693857409595503,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:5520
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2bc,0x2c0,0x2c4,0x294,0x2c8,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,11364686767684977920,16640906701107452528,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,13513557829456920544,4095343493209645498,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,1737195460717464951,6200141832714705414,524288 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:4564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=936,i,12758333732831055814,11259690636183624074,262144 --field-trial-handle=2000,i,12307076844312615148,16266868062623397924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1052

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3464

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4d0f9e211445afbb3b196cdbbfa899f6aef43b8f515f1c3876e356b324b68269
MD5 3b72ddf9d8ca7827cf2e432075b42e8d
SHA1 570fefaf469d3651693a1f654cfdf6537f45d463
SHA512 0215b6634fb5b24abaf869c01d11866724ef0c106355ae7d9d622eaaa290f3f14277a23ad5727f15a4a1053c52031d09e2616aaef8d6da39016a876985d71c37
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnhLNiXicJFFRGNzj3:53q6mjBW7wRGpj3
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a2554715fcfc6d1f909b0ff312b296e566d4cde8d6db66432f82cfd59d716722
MD5 655c05f1594c0ed46a3bf6f832ad1ee3
SHA1 d559d65743948d3d6b8e549118725a40570b764b
SHA512 61a6b95e94442d910a4c53a8d3e5cae7b2da0b611057a2ab70bbe5e95b53bd12698ef79d9e989a54b01fe1a7558232ccddcbf3225492645a09f55ce02cf249cc
SSDEEP 24576:MXYfDtczAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rtcXLNiXicJFFRGNzj3
TLSH
T1B175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cfbec74c46c825bceb587f0b5b88cd974dfa0e684a47353c70b542c95e5d52b6
MD5 e9c1d11a0397cffbc37463879aaa0d5f
SHA1 9e63821c0daaa9a873b785f31007bcb785e9e05e
SHA512 aa954fd4f4e3860c9387bf16433f819b7255da49cff6bd3018980132dd63b91208a30bac7f733ab3d95d95709dacee10b4f2e7f26cba1633bc33963152530477
SSDEEP 24576:60Le5ji0hmxhrMp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0AzcLNiXicJFFRGNzj3
TLSH
T1FB859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5bc26806f75374b1e6dd8b3f4cbdf035ce1db8d1142c6d6d5c33422fff8e18f5
MD5 8f89dec72364867243fea931392d9aa7
SHA1 34ce6cca64d1409b78e98f780788eba81f21c41a
SHA512 422ac2ab04f4b5963a5bf86d6ddde184dfdea58b0e6e48d8a4cd5aabf3359300fbaae4da409c925424125123a580541886a9252a7be99be96792a058c33781ad
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWj6q8wyuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L/ezSC6vUzPv+HjywLNiXicJFFRGNzj3
TLSH
T1E3756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1d93ab85b1bc038a62a8449bc12094e80af55cd93531d402925b93bb21232203
MD5 f17ee490a27b88b6bfa6dfbd84335ea1
SHA1 f1b676d28290b055a88e14d19ac12b482ea2d24f
SHA512 7af9bad89825a6c53cc595c2ff0dd0385ad3600e18bd4ec1072142a6ce4ed30703afd1d510e93b5edafac84cf0b8786a49db5dd885f04f88e552cf75da5670b6
SSDEEP 24576:lVbqPb88hv/l+BG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+8LNiXicJFFRGNzj3
TLSH
T1BD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6cb90bb1163a5e204fbc86ca35224d1de4f7598fc68d21cf4da1892d6fd2c2de
MD5 6af86d651759340444e2e27df4fc135f
SHA1 db572ddbeeda7a9d6a05191c7eb989a8e5ca660b
SHA512 741d022557bfe491b586cd8e6e3356a2c7a001283ecb12cdbc41d6b22394bfa1bf76df612ab59d6383a82a7acd5559abf040b8e378d2381c5d6b5e5a9c5ed138
SSDEEP 24576:RGl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KLNiXicJFFRGNzj3
TLSH
T14C5523D3468855B1FBFD003A867A5828B5845E2C8A695CE3D2503E5E917CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 790ed49f9c20954f763e8f3f880a87893a15bbf9641726a876e6adc83de8087d
MD5 1485e4e32be1b836ff03ed7eea1558f2
SHA1 cdf238dc7c0e21d26129d7033337c5edca23cd0c
SHA512 a3456c369fc13c6d70ec666900cc77364ac6c207ba42fded2767e5e0a4e0f9e1a62b3456f48827e2481d1887cff3d943f91052853478780710deb92200a696c5
SSDEEP 24576:QJIUu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJIUuLNiXicJFFRGNzj3
TLSH
T10C75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca001af4ea5f5679b7e0e110f55ac3297e84d3cf71fa1f700fc22221b3c7106c
MD5 9da2ade19073a074d1e5c273eb67bfeb
SHA1 0a1b471c5a9776e5eadd06863ecc827e3341b447
SHA512 c2c1b2259401dd2fdc042dc86d79ffd576d06c12d7da8afce3a8f27790ad89f52c0fe01367afe7f36995a401c47923d9c390d05841573f5958523691c09ec9ff
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THQ:gQvGAdlCEL8c/WRNw5C37wRGpj3
TLSH
T1B4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a35d39fed59a1dd1d130d778bbdc0e16e29690ce0a2dcc79aba1c2d716bffd95
MD5 1cacfb22dbb1ceaf7ac069b3a1b34e69
SHA1 94cdcfb5437190de70a26fc1f5e060a805c0b520
SHA512 724a15ec76f4b5dd465e60f3d9bded48b88da1c1d9bffe55b57d7c2010ea7940f30a155ad5065f20b17fea4cc95da324e21b6949977ac2b6291b20f40b80b4e8
SSDEEP 24576:ifewsAjM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YljMLNiXicJFFRGNzj3
TLSH
T16775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 64bf5deb3ab1cc6052aa573af0b2459b20132459bcd64ad5dfd6880c8246b1c4
MD5 a6fce82018198044cf7112fb9a61e23d
SHA1 d6f3d52643561d4587521c2eb5f38738c7d9fe77
SHA512 f88bd7357b9f20a053b15c0c736fde1530ff6dd450156f2ee34932598d2ceb4d7acf543d140a931f0a5c7c06a65a988b795579c14ddd639e2cd95726926c1b91
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHwF9:hUEtQevvqc2W1cpV20I3209
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 613cce15c74404e650425b84eddc4a51cf4e8ef5fb1ac0e2f9327937924e1a54
MD5 a31e4c03c2fad0e1924da7f0a80c77e2
SHA1 e9e92422be3d1910d19d1bd58563e7d996815aa7
SHA512 ce6bbd62ca19a820894354b449d0df73421d292d6dee7f14551eefac7f7577262fcf7c509e872d76c820afad6d6fd981534ed4dceb90d831b8a101dd050478bb
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zsLNiXicJFFRGNzj3:Hoq2Vjnmr7wRGpj3
TLSH
T163D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e4ef5fde2aab1b82438a221e237b5232ce9f835a0ee063b1d9bd5eb0dde8f0cd
MD5 c051557549a57530c89a580ef1884c97
SHA1 f3a7f0033e10b29551e6b5534efeb10bd8752f68
SHA512 0684be94c8292a13aef01f9f9fb20aaf5a383af96880f47088b2677d3bef349e5953650fd310eb3540516837aa22e01bcc9bbc4c47f2615220e9fe482842da99
SSDEEP 24576:JAhGL6IFoiwtA5l7S53L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JAM5Foiq5bLNiXicJFFRGNzj3
TLSH
T141359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9904941d6023e1a23c55360325d31d7fbc2e3f0c75162ac39270f4dd620fe046
MD5 d5314d18983f5edc7c4563f257172972
SHA1 b7800722c116deb01344f2a8f5c295a7bd2569c0
SHA512 ef219c2b0a302c87dcf3f56413232698d95a21ff9ecb8e24477958d4e05406bc4947bfd3afe8068d2e72e2059d63bb66c9b07c870b6fb0fe408875938f8ad809
SSDEEP 24576:HwuROWQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HwSOvLNiXicJFFRGNzj3
TLSH
T18665F18672940CF9E9BA41398657C036F7F2BC152A21DB5F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b6aa40a9b5b29fe5fa0c51b760cbde742c25c6261f4d7c9bcfee9962149b9b99
MD5 b2efb6463951ff51b6388cc23ad4cea5
SHA1 7f59a55bbb55793f4ad31b3314fe3b53f0c91faa
SHA512 d79159486ddde8db9c3f62afea281756ea88bab20b6fc7c1fe4d870c042eeff60b58e44bb085cc37d9ecedb1fd765d6478b0558b10a9e98de4f1d5540f8ceef9
SSDEEP 24576:5ZuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T18B55129622C820F5E6FB413DC9B54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e2fbd63c02b5359c151edbd45b5dbdb2570dae63d3e383f72e5370d493ca4059
MD5 707288ea22fe5427c640129deb8effce
SHA1 9098d4ea544e5e33feb3a5d6eda201db7091dcf5
SHA512 23c7a7f635b642b4f2e8db1444812e6b8016b0d5b968b9cf03f912cdefa6812f690a3b0251fd73bb57ef1d7d43bee87181a3bbd0cac85f38fe2f9d859bfeaa55
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7ae98907a049f3e646fa8235b1e56b2e0068e5ab6bdace8dd345634fa276b888
MD5 435dd1054b9f0ad5ea76955d75e21229
SHA1 6fceb4a3da05ff6dd9ce450955befc80e5d42636
SHA512 2e9b6327a557499105ed7325a1742201bd253c96bae522b8324ec8d42c53ac770813c199d1a202d74f06c720189684064f1d5f29544c180544b515efbd952b8c
SSDEEP 98304:hQRQyi36YOcPDLvw2gAf+PN3i7wRGpj3:4QyiKanX+PN2F9
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 926f654f13b505caf4f6955552eb78ba03d07eb03865416e55f3973fdf40adb6
MD5 ba7e6bb73c7f344f125167be22f5dce0
SHA1 5a027d301e5945fd1347cb2a6a44b3f451ecfaea
SHA512 390a9f8c557f12ea71b671c4077f3f5e08625f4aee703eb652e48ac31f923872b400a332c021f43a99af72cf262592e8e9bb8a9f6a465e3aa796b1d952efa1e0
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqLNiXicJFFRGNzj3:ju6JmIxd2dq7wRGpj3
TLSH
T1A9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4180_13431587093858319.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4180_13431587093858319.pma
Size 696B
SHA256 d090245ecf7f9111f1ff63afd5046446a6f5690f42914e47066749e2e1d3cf4e
MD5 58da715b8e06c018cf506420ddaaf5dc
SHA1 0bb14bb5c7203ba17d4d7850d0c064e5e1492652
SHA512 758016846a0595cb8e814c724134ea5018d671dee5bdda79cfbb369578f0c4dc1577ce7ae6c9def7620f335cda3db58e15d0459f0dfc6f8c25e5750ec49a5ad8
TLSH
T17101C946A3144F77CC428D3584BE27552BB0FA501B821BBF7B14724F2E021C8AE99168
MD5 SHA1 SHA512 TLSH

Submit Download

5444_13431587094049774.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5444_13431587094049774.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b0f6f17136c06c453e844d16dbfcd95e44e83cd0cc72de0b26d0754eb6bc49c1
MD5 049919cace2f461877c521bf29ee3ac2
SHA1 473d9f8ae78568f97c82cb682cf1b0864f5e3e86
SHA512 0ec224171c4a5a1210c1491edd46ca5a2e4b3418a49ebf6cbdea4b6f311705b4f4c38fc45515e6010e509beb31213e67d50765260efb309c0370432d3dee557f
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KB5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CP4m4IpOO67W8K3LNiXicJFFRGNzj3
TLSH
T10965AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 17f60f53c04e69977f2f182ee0660d4d33c193369fcb51ffc814ff06e5da5056
MD5 1ffb9e041b840f8ebea4795a2062c878
SHA1 318dae080640b96f6aedbde9cfceeba3106679cf
SHA512 5dfd8a91024dc2d662b41aae02de243e7e8c03bfd6755d2c09d0308bd0d6ab44c079b46a0a0b3c368892749e4924e1cdc4eb85c960ee4d422e1c21890f0939bc
SSDEEP 96:fMyayFTqXO3jeEXjhK3sK3NJ1+/cHUwChK2lK2cqlIWqkqgzhg:G+l3pPUC/fzmkqgS
TLSH
T130F1CF9E4E02486F3B818B6B334332A05E9B140AD7E495723BDF9555F0CA979142FDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 087a73dbc26be4737995656f02a186148e6bfe4634f9a2b46e15fd56ab7bce16
MD5 7883b5794e0761fda6f75ef1635ce913
SHA1 dfc0a0684ea91f8be5916ba9a979a73c003a9ebc
SHA512 4f7617f16b76b8279a373b28980944fcf1a2c55de05c0980e67861dedc95df8b9bf352594a955b391113e948bab8284bf179d0dff5276480db4e4908c178d610
SSDEEP 96:fMyayFTqXO3jeEXjhK3sK3NJ1+/cHUwChK2lK2cqlIWqkqgzhiP1ZhK3gAK3+Hc0:G+l3pPUC/fzmkqgmdABHx
TLSH
T11212CD9A4F02496F3B828B2B334332615E9B140AD7E495723BDF9115F0CA979142FDB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 aaf079ed9afc9a46283c1f073ab5a7d641290078f9a4f9cf3731bc5ee3bcd574
MD5 88706e65fc1745821f56d27cbfe98427
SHA1 9be8743a9a2dec74f7c21de7f2a7e29408d25ee9
SHA512 349b21ed55502fa3439d34dfff2ff1ecbd828e3fd02fda86bb4dd113bc2f526b59ca9e2ac8340a2077bb222196238dba3f19262ef11d39414234fd2545242a17
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d612830f26e3d2263f312d099db52beada174409b626d3618ee798615ea54759
MD5 bfe14f8346be99b2c9fa70d420aefc42
SHA1 5a9e4d5dffccdd82ffa6adbe5e5adfaa0d3ea051
SHA512 d2b8a38484b458bdaa6d4980197760f67b9b5c9db55992eed7ccdb6e8255b9d14f93b640e3c357b490080fd0cc2a9a88c87dbfb4725b526c0c864c16d22e52b5
TLSH
T127E02BA9DC21AC271DFD1B6861101746E76003163F95C90F3B3D820C8FB5A7A456AD2C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 56483a879638c3adb6cfad63e8e3afece4b8f8f15c1b13c196ce65936fdcbaa0
MD5 4fc104340904881023dcfe0d200047b2
SHA1 bc5dbcf0c4da803df7db9ae34509b1d04b83e021
SHA512 216338cf37133145cf29824e223dec7ca4a5b844e4537ae34822cf2d2853f1cea0ee991741f55ada19568965fb11b146de412d870ab9597ec139202b5168107f
TLSH
T1AE51A9F7D3E8866EC91152F4DB256E1FCE790A24122C3D6688D4AF5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b1d22963ebaa388521ff9010fb66fef2691e49fd051064ca725c997561edb14
MD5 b03709ceb1290600a11fdb4ef30a46f0
SHA1 8050e69265f1bc4ef5c6640944f42bb440aac5a5
SHA512 bab4d73c642993a3a7cef646c24548d2af6dcaa1c1dff55a5a27e0b64b68a6c92ab9c8df89fb0d760a3eb6c767055f08fc53d8f59df0b3ce46feccc8e59c1a66
TLSH
T1604148F3C7D8897D890156F8AB192F2FCE790E14536C3C5A89E5AE0B53E1871E24058F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 44590193c96a069ae2abf30feff330ad8fbf9825302dac7bb7f28b143514d5fd
MD5 831980c9eca19fcb38e48b10b2414e05
SHA1 4544290a0438101b8d986da07827207edf11da6b
SHA512 43ffd12f5e719d3bb9bbaf03c4b655b5d79e7e4f6355c8ffdc4ac8e0e10bc8beb59ad0aecf5621835934a138886dba61c2f31fec95966971fa20a62de618ee60
SSDEEP 192:xRRaeHnk50czYv7h9PRp2mXsb+WNnJl2+E7le4cuiyIsnAUgR:xRRDH202EjX1XwD237XsR
TLSH
T12132836DB914797B6CDBE229ED223653E3F6106224911E84EAFC853C15D7ACC223781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 902dafd6d44b4d2e217eda9d9d01b0fb09f816c1535680be9ff13c8cf72ad04b
MD5 2fa3b0bc982c34f45466a89fedd2d33f
SHA1 a1784bd861c8b7b20e2d68fa480bfa173cadaa04
SHA512 f7eda59f7987aac4a6a0fd43eb0a1e16e138e9122b505fa27c739c82a5f00b33bbb5271cca0ad9831f42b4faf27bb66798ab34f7fe54104f10a3a7402e398e06
SSDEEP 192:xRRaeHnk50czYv7PUPRpVmXsb+WNnJl2gfE7le4c6iyIsnAUgraJ:xRRDH202EaXQXwD2x7Xae
TLSH
T1F942842DB914797B6CDAE329FD227A53D3F6106120951E84EAFC892C15E7ACC223741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4f1fb36ed713eaaed574ab275027f4fe3a87a10a33d2c6ae4ccedce5080cf30e
MD5 1d5101aae7d9e680e8d8cebdb0b782e3
SHA1 40cdb5bfb7b8cff5df975d702686e37eb5261b0c
SHA512 92eccb6424a4b6615db51aa8a75fb02313cd98cf4f0b5db556af0e01b967f41fa9a5c4bed906d52b5d9385f7af43ac83d241b46b4ea4310a63980d081597a224
SSDEEP 192:xRRaeHnk50czYv7P9PRp2mXsb+WNnJl2+E7le4cuiyIsnAUgtaJ:xRRDH202EJX1XwD237Xs8
TLSH
T12A32832DBD14797B6CDAE329ED227653D3F6106120951E80EAFC892C15DBACC223781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d136.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58d136.TMP
Size 3KB
SHA256 02e201a163f14f883bf6f3a744fdda134490cbd7ac1f746a330bb623ec8a7b4c
MD5 e1cf936866127bb6945b0142837afa3d
SHA1 b3a433fa8cae574fb7fe8f7a0d42f24ebc4d5587
SHA512 64da674cb8552dccd83598784a4f75a72eed5b2b7c29ba8ac891937c0ad2deadae507e573fad3d7250d95cc6020660731b8af3f4c129c59b0ff7ad91091046c9
TLSH
T111611068C0780CB71DB3677574390F81FE42832F22516C167A7E168D5FB286B8182F9E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3f0a5e7fb108133996bbc138c3d9eefb1061d3601865d6227890caa69863952c
MD5 63bc364025a548d976a938460e33a6dc
SHA1 53592aeb95b2e8e70f970c5492aa1c1c0200f5b2
SHA512 d36bb44af25d2db2c2ad8ba803a30ebbc1cd0ea848500942c1a087ee723ae13ac16ca65676e128b4754375e44a2f19526b2e0ad7b37cbbc2b5dbd363ca71112a
TLSH
T1C5B0124180455101C05602B01BC6248872185F10DF0F5F0143F0B933C8261618029050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5919b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5919b8.TMP
Size 96B
SHA256 289727f1b9f827b1f4c5b2dad8818262ebf42167e3b21991c625bd926f0d288f
MD5 32d5c66ecc5f544133149aca31d20f01
SHA1 0e0e454d07050e1c8b884a8d968268c170d1e962
SHA512 e11ad769e414f0a9736ebbb0ba16a6e943b9fd94e4ca0261984e81cbe083385f3003bec5e7555108920d0da5615d1b2663a60dde095a408e0c37385fdff2f2bb
TLSH
T156B00255C10A6222C8C643B0259695D87160DF29E6471326D3F01F77DC256B24AA5161
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 d675cbfb4178e65b1c81085830c806c46f5efc7aaf4271330b119c44ffe465fe
MD5 e8e8a3f0c538b28308c2e84518fea724
SHA1 6808870471b18b21a8715837e7f2b57252625f57
SHA512 b9ee12b1f666df173fd966260d67a649e0d3c0093902739ada119bc7a0813a5417dc23214e5985d04531a1e90bc8ef002f05a6ba3dcd41a8e4f5f5cbac2652d1
SSDEEP 6144:NVutftP750fnpqP/8W3WqJrdOK8YhI2FmUi21rSm8uUVNSlzYE:it/0fpmDxQKFGGfi21b8j8zN
TLSH
T1963423327B577AF79A4A27406ACB2E4DCD00EBC38991CA011DB7AA415ECD3853BD4F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cfe076e906c3940e626eccbcd0ab8ab05cf504fba079fe5c8e2e7d8f74ca48f0
MD5 32ab4e769c15feb96227735723a477d7
SHA1 1eb03c429c7a6590389e495d1512fea90fb7da5e
SHA512 4346bb82c9441fdbef20f501f7909c22616fd112691cfc8e3b6c21bd70555536afe1c8cee315027272e8cd378f54a63b29b76436093f9a3f8a40e83b0b0d617c
SSDEEP 3072:SfFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:iFmUi21rSm8uUVNSlzY/
TLSH
T1AEC3130076E3F8F2EE5930447BEE2A149D6C4D818291C64156739D419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 868d7762478779d4b25b95e349cd45900c0a7cf8ac69213cc2f73e918835afda
MD5 2ec96febdfee9a3c81162ed5e5be9d85
SHA1 b4fc989b356c393086df91cbde91055d2e4b6456
SHA512 336e0c1e8c6e5bba3ed307a525ffc60915c91347e87500743009121f59470f367e1fceeb6a655bf8b2b827c082eee3d088bc01c840bb5b13b0c4d474ad0d046a
SSDEEP 3072:S+FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:/FmUi21rSm8uUVNSlzY6
TLSH
T1CEC313007AE7F8B2EE9930447AEF2A158D680D818191C64157739D419DDF3CA1FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6a86f3628f2d52d7dfbfb05e43e5dcf94739cbe7a5c202e0ac1dec45653f587a
MD5 8c3f845c7a3cf111c4e36fba9842a2a8
SHA1 006cce52170fa87a9672a31951dd0e1ae7aba8a1
SHA512 b7594ce9f4a712213bf7169723cfe9330a00f7a02a351dea5fdf3ae097fd07cf3dc51388f337bc1250114c11e0d59477c09152f31818b74edac9625d415a23d7
SSDEEP 6144:ButftP750fnpqP/8W3WqJrdOK8YhI2FmUi21rSm8uUVNSlzYE:At/0fpmDxQKFGGfi21b8j8zN
TLSH
T13534233177577EB69A8A23407ADB294DDD00EFC29591C9011DB7AA814EC93C93BD8F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87dafd132d44b5a9.bin

Path C:\Users\Admin\AppData\Roaming\87dafd132d44b5a9.bin
Size 12KB
SHA256 2a1c8d15d367447b22da9e77b3567018297ddd50ded8244001bd4da032014b77
MD5 f842461082fa5592efde4590f46f9cbd
SHA1 3364b4362de141d13956cf0eeb6adf1d7c7f5841
SHA512 69b10c5d985bde6c24c1dc194c0f1ee41653ff206132c124a6f4c99d5b9de59fd3a02ceee1b8f14174961a8f31cbc776120a51896c4729b810d0975f67ddbe41
SSDEEP 192:720DX+oMlApRC8WLW7gltwwORqgXc1nywY6edDFVwSIEJfR8k5xLom9OYzaxlRjX:72tmRC84HlSwav+YNDdfR8dm9MfRjX
TLSH
T12B42D0B975C60B23F024F873DB48C905FD48B69C095F83AC97A2EB5CC49122272A84FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c27d6ad2ada2b6371de3c2cdf6b4a315054c87bf41ca82955720b51fcfbbab3
MD5 efec0fa5e2a0a2b9372282812ddc9eaf
SHA1 b68d2ff50a36aadf43aee2c8c46082e03c0127f0
SHA512 8ff085f2d0940145322b2358cfbd1ba852e0dc2045d17f4c091772bc6b493b112f72001f2a62d1d6c987d2b81b8c79c8090fb27285e2e32f8f5c9e84160ee4de
SSDEEP 12288:etiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ex/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T148552393968C5572FAFD1039453A8438B5497E2C9F1598D3E2043A1EA278FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1e69afa1f04bd71050a4d4b6a2e7db798d1cc09ccdd7c33aa284c94858eaa0cb
MD5 29582cab8177fac63bc7facc895774e0
SHA1 ca36d558bb55aced51964a75cb8895262c0b7731
SHA512 593d9b870f00fbad0a2fad02dd74b041a006197dd08c2bf516c57ecf0d371b7ff32343a44370cbc015fb3054844fff82f796ed89bb24710ada61b183ab7f90fa
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQjLNiXicJFFRGNzj3:da0hNYG4Jwk7wRGpj3
TLSH
T13B85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8774ba6e9e2f63e583c0e3019f17eb40b92e86c453637a416bfd5a5074d084cd
MD5 40c3cad50e09b680a9c2d80c7af7ee6f
SHA1 f6e346892c77209fbcbd06f61aad59477efd4fd9
SHA512 e7ef28aae6c2c66d59455cc77c401e7871cdfe39169c5377a0597fcbe6e62a37656418dd05ed6717c67a103c3be791dc6732c0f6bf80714629e29c8f00015059
SSDEEP 24576:phbHjPY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:phbHjgLNiXicJFFRGNzj3
TLSH
T1FE5512BE169C20E5F6B5903D8566840AD370BC29172197EF6381523E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8774d63de4b121e96f9891d9583427fa0c2db586e842d0e37bd9e937d15a62f9
MD5 f1671f01cc16752d2b3320e994b640da
SHA1 541ea41afcf434f09e634a6dd9e00b365cc89c01
SHA512 6598b50aa5bc32762420d563831aa2d7c51ee3d8eccf372b44645c7caea21cd0bb7770641dfb8e557132f340571a5c8bb3bf9c603f074d9869ef2017c2a0913b
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CIgnaTk46pBR/QLNiXicJFFRGNzj3
TLSH
T14545B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 668716cef932b2e66bbf9e5b9ad9e5908a62bdf143dfc15197be76e7740457cb
MD5 e938b013a1586105e4b009f31022076c
SHA1 8f54bb6963b5fa2436933fc6993a8e9959b12ff7
SHA512 7a7ecbac770ca4df6f7cfa1ae90a456b1ed0a5cef56fabdd0b338f6df61308ae81d74ecc191330a09706ead294d9c56e75e893426f3a79190be0685bc5bd9600
SSDEEP 12288:eZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D2518955B1EAFD003D86764428F5842F2C9B2619E3E1543E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6a703b0ba3d9da5faa1cbe424edfba964d174f7ddb29cabf9c2c052a12542646
MD5 3ab1f2f6b5860f238ff5845f68c90ddb
SHA1 c3714aa9a1e47b41e5f0f8d7f7135a7aaf3c51d5
SHA512 69236dec8d69453eefc42c342335c1ca9c60728c9c28b894750e349908dd856b957234d9057d181000f4c4fbdc281a0425215744e63f196aa04b95f161c1aeb7
SSDEEP 24576:jAL3UTa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jAL3UuLNiXicJFFRGNzj3
TLSH
T172750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c60c649f6fe373ba4af365c27e21b90c1acc0730c79519a2e5c5d37943e02cfd
MD5 e5b034bf1f8a1aa1ec598cac0c77a05a
SHA1 d3808ea9f679ac5925583785ef174824492f2cfa
SHA512 01c72b59e086ec6296cfb275a4cb670b579169411cfad101b51151b98e2b57314552d281bae60bd47eac9fae5e51a04169c94ecc6c33119f10dbf0c027b7eda5
SSDEEP 24576:ROO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ROOLNiXicJFFRGNzj3
TLSH
T14A55125A32DC10F4E5B9503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 394546d921ba5879abe29e10d1e8a4311bf5648a1ec03725b9dfdf8b2e7d2578
MD5 2537241c932d2b55d5704f686e6594c5
SHA1 1fadcd73933567c3ee502f21ffb3887a6e5c5d41
SHA512 4db410ec36b8961d5bf1718b7203edf08f79eab21532777ac521431ebe4d5757c13bff6c0e55df6806ec5ae44d128ca56758fb6a852482b423ea2c4c33b235e7
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:37cBWMpPjN8DbEh4LNiXicJFFRGNzj3
TLSH
T14A65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 624c8bb36742158e0bd2df9c6fb729da1265d2269f8f97ccdaa7b8d07c36729f
MD5 c2142184b8c298bb186fc3cc4ac42ed0
SHA1 6dccc26f354f7546192c9c77a49a7264722dbc9c
SHA512 c5c2a1a7f955da267a7ac996414a26f15aa30dedbff4546d61650c0f8ec0c4454f37bb3da97398a42e0a62046da8c70a8ed4c79879aa03b8a5ae69af42a1bb06
SSDEEP 49152:uF2YuHNETovAvNYf8kmhLNiXicJFFRGNzj3:f6BCf8kO7wRGpj3
TLSH
T1CB858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5c5437a44e971b70828d38ff6da5114de71e02cdfae22a1644123e14002c3a40
MD5 b837b2b7dafcc880a042191209a73c99
SHA1 e46261590023d620464cb68e7a27bbb0436931b8
SHA512 836fcb23f26b5ae5d41fd0438277c23f6913b0b7bdf386c5d96e85ba97b2042e4b6c1af875e7c27be757f32532679a35c602e162d66f868f7e4e135ec4952d1d
SSDEEP 24576:TAFs06+Omlf8NXEbToC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cFs060loXuDLNiXicJFFRGNzj3
TLSH
T12C65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 023da033fdebbb72a01540cde6275e21dbe9ea963c25cd91a20e2dd375b1422c
MD5 cfd533ca2c84a2ccedf01a7e53fe91d2
SHA1 f4f55fa5c92deb47afaa014b74fdf181c64fa091
SHA512 547f4a64505cbf7aa4ea5ed21f607f291fb1dcdd3d6c23357c8925a58d7710af306aa3b1235e3133619453e95c87308ea4f09d891ab335146e80c6ca520f8745
SSDEEP 24576:bJnJ5D3WXD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bJnJ5DGXDLNiXicJFFRGNzj3
TLSH
T15275D02DD29810F4E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c2a5dfa3ede3fbc6204a9b61d16968e38ea67bb7ca055e8fdac42dd9930296cb
MD5 a335f146ef656201a3d3810d52225347
SHA1 49d135af2ce874ad8b1700bbfbbc33624befda32
SHA512 5cef4cd0f6850cfedb3ce84c4cd0901bf93d1daeb1bad938a35798733b194b0655fefc925481a87247f089a053556ce0087c2349db7afd92c4fb23128fbd487f
SSDEEP 49152:qg06DIKdwc+eQnSt65aVNLNiXicJFFRGNzj3:D/7wRGpj3
TLSH
T1C0956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8a371c1df23d6f2dd7a274ad8a8a11a446f344a7dd3bb5ab777c0b6f3855400b
MD5 82ce917ad0084fedefb759251ce441bc
SHA1 2e0239a54c18d31c0cc7a9474a09bac82cc92a75
SHA512 3c8a3782f29d475ba554cf40877a617776f1b4165f42dd4d6ecfe15fffb37af403d163db0a02022c9f473bf47910f1409033cf586a3043b340c893dd75543fc3
SSDEEP 24576:wnZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wnZLNiXicJFFRGNzj3
TLSH
T1135512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 031fa1bcbf817b88c594b1661a9f984c9f4580abf003b46b68f7068f572162cf
MD5 d7df5ecffc569e1390430357c24350ed
SHA1 0676be97258dfabef679ee4936b2c2024e590838
SHA512 b2ab0785cd46449c0b36906bcfa87e2567d117cffe8feb5b560edddac9aaf281e01e5433bf8589400a8ceb9821bed6f62ebe0170ad8227140da540fcb9b776d3
SSDEEP 24576:OIyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OITLNiXicJFFRGNzj3
TLSH
T155651245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 89d2696e4d10415467705f49918735fa777bf0d515a04370a493e5bae06bfec9
MD5 31adfb01ba848b1902241b7d7264f695
SHA1 dacfd402f2bb398a6d4fa60b2adb99dc0b0bf94f
SHA512 7d6a1d73ca5b29c135374f02c3bb2049b126f38756d197d74689a83c689429aa850f1deab1e5be6e9c5e0db35b88173d0fc28fd3dc378e9403480cd0e5406e9f
SSDEEP 12288:HyUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T182552396118965B1FABD003D86364824F1943E3C9B2618F7A1947E3ED339FDB8F38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 54ea68dd421d313f338d20de1b470e45b069bd291bb7038c975f6566f5ea25c9
MD5 dfa56b9e3df20d16ef2365add80e400d
SHA1 c11dad569e90d6490e54f7b87e526a38d7d2d7de
SHA512 e92bb89c34a2c8f33f8aa31692f7ea18e18f0a16eb58311842aa79ab55de5e1abba7507ba241700428362f1f39a16f96d6515a28b34ecff41377ceb777ded828
SSDEEP 24576:zQ9MxZKdcz9dw3J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zVKZJLNiXicJFFRGNzj3
TLSH
T19B558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5059514f5daf3f90a83c4c826f7fb03f25a732dbda20733ec2ac73c29a60a146
MD5 23f6673ad7f47e392624dea377d22bb4
SHA1 efeaeb48c4c65b5b05cdf45bd3da97c18ae52a87
SHA512 eb4ea55e8884c989ee53fda6b2aff3c3f6c7495dbbfa3e9faf351c1b47dd0f561adff118ee76370694c51b5ed76732d3466838dc322a505425815cd9398a4501
SSDEEP 24576:dyocDApM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gocDApMLNiXicJFFRGNzj3
TLSH
T16165E05FB76D40A2E176813C89858204E7B3B4345B6257DB5281C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 69397341ca3946e8a76b29cdd3671a5da5c3ad9cddcaf19819948e240f5ba38b
MD5 2b0a18262e05b23a0b6de1ae50abc0b5
SHA1 6a0c7acb2397f701b65a748ce2e3fdce79656969
SHA512 bab1dcb0f94f44ede3f7d93b3d130fabb158dd44dc78e1efe6c694b454e10dc73d7aaa6309834daafa7161d44887476f8216780dc468a4fde6dbd74a43d22677
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKMLNiXicJFFRGNzj3:30zuNIa7wRGpj3
TLSH
T127A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a1a0450e6a50174b82c26c4a34da1a6bdb0072ce580499af0edb4bafe8360407
MD5 a9e73a88bc6c590d3d8a10dd0b97d79b
SHA1 b27e15b39fc10894bbb8ffbf88bde907f86fd79d
SHA512 0b2502ed9a4c1f7b1c52b8d0bd57280073264a08b1a4bcd6733483e779a3e6ba1a76369099dcd20d20fa0d45a28968766d9f5e29c5617e110403abd00d93908b
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYzjMqbn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ETDxR+N5YzTBjMuLNiXicJFFRGNzj3
TLSH
T13055B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e801f51909db4f275d496f89b06257821067c508e71368fe17b066a940a8e3fa
MD5 b0dca2147fb073fcf80a651a0a1f1363
SHA1 6793db6ad20f67c41dc63d5fa78e7894d078f153
SHA512 9181e7c47d6ffced107edcd14edc7405a8bea94de38f5f9385e9c34c6c8d4c4964a330b9a378b26e4b28f9a79370ecf5c7f3681cbf1b404f06893c780205390e
SSDEEP 24576:kTMdOz0FFS+UmSLr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M0K+UmSLrLNiXicJFFRGNzj3
TLSH
T1E175E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 85b8dfd1559eff67cb67d69399bb9392f73f82da4b49796f16f40a7d9c4cd612
MD5 11f96f8a2894cf3bf5bdb7ef43642af9
SHA1 33fe65b69137a88c2b5026bf817f00a55bd996b6
SHA512 b4d312de73c0b89d0e817df11aa85fe048c0b258e55d0385a4c780daff8e14130945925e636b9d248f6da08fdd230745897dce738a696e68584d40c5306d4e52
SSDEEP 12288:i4KoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C55125A13D830E0F5B951398A364014E660BC3957251AFF71D0EA7E9B36FD9CE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/884-134-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/884-197-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/884-132-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/884-126-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/892-185-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/892-471-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1080-111-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1080-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1476-499-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1476-198-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1820-29-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1820-147-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1952-17-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1952-20-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/1952-11-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/1952-108-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/2388-403-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2388-161-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2388-169-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2388-167-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2700-158-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2700-363-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2868-188-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2868-109-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2944-497-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2944-194-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2964-31-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/2964-8-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/2964-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2964-6-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3240-495-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3240-498-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3240-488-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3240-650-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3244-210-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3244-154-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3244-442-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3260-140-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3260-201-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3260-145-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3260-148-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3368-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3368-78-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3368-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3368-81-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3376-211-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3376-236-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3376-536-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3376-253-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3376-220-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3376-506-0x000000000C8E0000-0x000000000C8E8000-memory.dmp

Download

memory/3404-99-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3404-83-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3404-89-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3404-97-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3404-96-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3448-206-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3448-535-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3756-202-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3756-511-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3880-189-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3880-191-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3980-59-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3980-66-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3980-106-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3980-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3980-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4180-474-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4180-480-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4180-520-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4180-494-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4256-151-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4256-205-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4680-432-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4680-182-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4680-179-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4680-173-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4964-33-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4964-41-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4964-42-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4980-121-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4980-115-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4980-193-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4980-123-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5204-541-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-545-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-562-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-561-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-560-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-546-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-558-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-557-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-556-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-555-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-554-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-553-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-537-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-538-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-564-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-542-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-565-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-540-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-563-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-544-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-559-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-547-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-539-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-548-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-549-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-550-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-551-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-552-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5204-543-0x0000022181CC0000-0x0000022181CD0000-memory.dmp

Download

memory/5444-464-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5444-526-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5444-456-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5444-450-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5520-633-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5520-468-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5520-461-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5520-483-0x0000000140000000-0x00000001406BA000-memory.dmp

Download