890978a9b9d1b2db587a1cf4f74b4c48486922691f2e482e73d2a5a0b7d95a41

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.8MB
Sample260822-en6b4a1bme
SHA256 890978a9b9d1b2db587a1cf4f74b4c48486922691f2e482e73d2a5a0b7d95a41
MD5 6f0893d84cb06ceb933aa2bc03808d52
SHA1 341790753f7cdb24c922a72dc17d5b1c80e7c461
SHA512 4140dc847d17261c658e1d0b18911c18927b06e97e4e5170f066273a64b5c230207d520c67d35079ed62c0a90472db01eaf8d18528f877ecb5c6e0dc5cac5c73
SSDEEP 49152:0C0swYQhpObyFttSG/Fm8z0V2+GqmP3IbVzL/3eTwLxPm6knZl0gajg2aDDSeFOI:vQRCU2LzLmTWHgMYO2iX5umrLm
TLSH
T1B5867C13F2A501E8D05ED9B4CF3A56329B357C4A4BB092EF269436E11A75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
2268	alg.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
212	fxssvc.exe
4864	elevation_service.exe
4520	maintenanceservice.exe
868	msdtc.exe
5036	OSE.EXE
1672	PerceptionSimulationService.exe
1908	perfhost.exe
4540	locator.exe
5052	SensorDataService.exe
2108	snmptrap.exe
4180	spectrum.exe
3884	ssh-agent.exe
1748	TieringEngineService.exe
2396	AgentService.exe
4556	vds.exe
4840	vssvc.exe
1808	wbengine.exe
3644	WmiApSrv.exe
5144	SearchIndexer.exe
5712	chrmstp.exe
5776	chrmstp.exe
680	chrmstp.exe
3788	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4943450d79c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4136	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f14316a7eb31dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e113a7eb31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f86cfea6eb31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a399dda6eb31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3b95da7eb31dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f566b0a6eb31dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000998bada6eb31dd01	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4244	chrome.exe
4244	chrome.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3856	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4244	chrome.exe
4244	chrome.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5540	chrome.exe
5540	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4600	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	212	fxssvc.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeRestorePrivilege	1748	TieringEngineService.exe
Token: SeManageVolumePrivilege	1748	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2396	AgentService.exe
Token: SeBackupPrivilege	4840	vssvc.exe
Token: SeRestorePrivilege	4840	vssvc.exe
Token: SeAuditPrivilege	4840	vssvc.exe
Token: SeBackupPrivilege	1808	wbengine.exe
Token: SeRestorePrivilege	1808	wbengine.exe
Token: SeSecurityPrivilege	1808	wbengine.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: 33	5144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5144	SearchIndexer.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
680	chrmstp.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3856	4600	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 4600 wrote to memory of 4244	4600	2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	88
PID 4244 wrote to memory of 4492	4244	chrome.exe	89
PID 4244 wrote to memory of 2760	4244	chrome.exe	93
PID 4244 wrote to memory of 2760	4244	chrome.exe	93
PID 4244 wrote to memory of 4136	4244	chrome.exe	94
PID 4244 wrote to memory of 4056	4244	chrome.exe	95
PID 4244 wrote to memory of 4056	4244	chrome.exe	95
PID 4244 wrote to memory of 1912	4244	chrome.exe	98
PID 4244 wrote to memory of 4780	4244	chrome.exe	99
PID 4244 wrote to memory of 1912	4244	chrome.exe	98
PID 4244 wrote to memory of 4780	4244	chrome.exe	99
PID 4244 wrote to memory of 3440	4244	chrome.exe	102
PID 4244 wrote to memory of 3440	4244	chrome.exe	102
PID 4244 wrote to memory of 4700	4244	chrome.exe	104
PID 4244 wrote to memory of 4700	4244	chrome.exe	104
PID 5144 wrote to memory of 5484	5144	SearchIndexer.exe	125
PID 4244 wrote to memory of 5528	4244	chrome.exe	126
PID 5144 wrote to memory of 5680	5144	SearchIndexer.exe	128
PID 4244 wrote to memory of 5712	4244	chrome.exe	129
PID 5712 wrote to memory of 5776	5712	chrmstp.exe	130
PID 5712 wrote to memory of 680	5712	chrmstp.exe	131
PID 680 wrote to memory of 3788	680	chrmstp.exe	132
PID 4244 wrote to memory of 5256	4244	chrome.exe	137
PID 4244 wrote to memory of 5256	4244	chrome.exe	137
PID 4244 wrote to memory of 5380	4244	chrome.exe	138
PID 4244 wrote to memory of 5380	4244	chrome.exe	138
PID 4244 wrote to memory of 5892	4244	chrome.exe	139
PID 4244 wrote to memory of 5892	4244	chrome.exe	139
PID 4244 wrote to memory of 4920	4244	chrome.exe	141
PID 4244 wrote to memory of 4920	4244	chrome.exe	141
PID 4244 wrote to memory of 5568	4244	chrome.exe	146
PID 4244 wrote to memory of 5528	4244	chrome.exe	147
PID 4244 wrote to memory of 5872	4244	chrome.exe	148
PID 4244 wrote to memory of 5540	4244	chrome.exe	150

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-22_6f0893d84cb06ceb933aa2bc03808d52_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.172 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x294,0x28c,0x2d0,0x288,0x2d4,0x1406b1708,0x1406b1718,0x1406b1728
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe453cc728,0x7ffe453cc734,0x7ffe453cc740
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8556227434222895738,15598246436525963861,262144 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:2760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,16016937712630955230,9699151717780415901,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,16448526600914871533,9776936914188312948,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:8
    3⤵
    PID:4056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,5566150181279126195,4472294481647405989,2097152 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,14636030485821611632,8807216049871292737,2097152 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,6235079679417625305,11337569405449605163,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,5723135307505000200,1317258265303868048,2097152 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,16283832174021671616,13107879595571939386,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2c4,0x2cc,0x29c,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:5776
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,11689637772831699141,5358608434225538746,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,10909817788105555088,261609924648848296,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,8062804400518548182,6002158423039979076,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4876,i,17817439719337244432,7727955696412060231,2097152 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
    3⤵
    PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,2240413764423518730,3070626521851155184,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,9690593972461472885,12237567011647226394,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,9392095915822190784,7696559414424899920,524288 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5684,i,11411058953518054325,7482053142122988702,262144 --field-trial-handle=2004,i,8571658130514735940,8477098064308634707,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1908

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5052

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4420

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ed1e1f7a076a061b1107311d15a99946d9e6b77b8dc2e6b5ea9fc89a5cbda408
MD5 9214da6c37c87fb184a15c7795365152
SHA1 42f25e5b6ef5e9798705f36d0a0ac0b3ff8efd17
SHA512 6f0a52866c9d3761e2d3372cac3c653438798cb30807f28b37269fac9e51c3fe5c1b33ce911a42c21b0344b71768978d31becbf09d9e597b606fa0dc1ebcc0d1
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4:E3q6HjBfLm
TLSH
T18AD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 42022583422e0286833c9ada386eb5c7f6851425ba86672da41d800bf5e04f3f
MD5 409bc2c4023930843dd888dab5164a0f
SHA1 f2787c2ea4f260d099ee1276a44190c306f1d95c
SHA512 a1d90ad9bf499d4ee42802d10df7611e418474e5f74e5aec77a31df973b3b767bb62353ee54604b9f4aee931b6f6b4603d39cf8cf727a008872bcc545484e193
SSDEEP 12288:e1XLsswWkxy2lRq2czAgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:sXYfDtczAAnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T12C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 607a7dea5ba752dca56f309c99be3688f4d88beccc6e62b21a0aeff591cb5b23
MD5 a69747657f36fdd2581cad3fa5ae5502
SHA1 724b2a1cd4e4c24d7fa3a90143ecea355ac65031
SHA512 d48824cea75f27bd5172b514d65822b698d3cfd357a1b4f7fb60bb6a3148cf591d9eadef8dddd17b1efabac2a1eba480fc3e18b42b4e12350f051515f2495add
SSDEEP 24576:F0Le5ji0hmxLrMjnQ/tbw/2Mkjy6Fr7g0op:FPji0Al2Q/lFTjN4
TLSH
T1EC859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 58993ccc823a315b6e18cda815e2c9d671ee272b135ac4d715b49ad569256606
MD5 f084bd20f276087b4180af48ee6cacc7
SHA1 0da65b7270792489e1bb87a84b45f09df1e0f51f
SHA512 f0745ba819945788183585f94bedd4ebcd727d1c45150b7eb5c8a05900be5d9f8631992036cd99da1a89de24f5f6a1f427a3a08d64b8294496430020b52180f8
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0oS:V/ezSC6vUzPvxHjyKQ/lFTjN4
TLSH
T162755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9a7b5b34b2261d6032feccdd40f37d14d89a66f29912f551414f1e22a577d1f2
MD5 827d3ecbdc70a426827c0f476e452f33
SHA1 85305e1675c91c28dc28df517b433e77fc6f2f93
SHA512 6faade47833a5e2ac7babb64efa2d3782f6497f58cbd8a99293ced77d36654974bc638dd3795764b31bc521e26e71173cb3abd159a43c0514729252df7f79595
SSDEEP 24576:IVbqPb88hv/l+6MnQ/tbw/2Mkjy6Fr7g0oJ:IVO88hXl+HQ/lFTjN4
TLSH
T18B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ad29fccb787ce7717956519bd49700e782212e38fe27bcc762771b14fbe65489
MD5 d69041c17537dc2294d0f2e62eb51fd9
SHA1 b744393377b316bfcf9f72ad28faa7d502bfd421
SHA512 c932b28f5f52d1676061cb0e3660458b9b39e852562662c1d47237d34d1d2d7132b9e899e47e0ac3acb628ca708701ee2e5f5df9915bf040f50d331535a97d9a
SSDEEP 12288:szPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:szvnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1B35523696A24F897FF2B06B15CD384826B3B0EC1BFD4AB4E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8495c22728935a3c30fe1f127596f02c52e722ad75ea8e217893689d61d15bed
MD5 9130797f02d48d1919ae6470548e1e3a
SHA1 921db046f9ee96cead9b276a51bff800fd7ffb6c
SHA512 3247b64b56c7d85f130d0d4d7e07203be677c2c27cf7ad9a595b144987570954a84d192cede8015284c8d1d10b18176e7eaeff3764070d00e009c00570d59676
SSDEEP 12288:jeBNUbTVO86UkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:jJIUEnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14B75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 33d09bfa9f9b6c0ff35d7ec6e462a2ad6f1204ff3acac43a89b095d03728571f
MD5 5fea8e1ccc35d78b400cc6d22f7044e4
SHA1 6581742f37b21761e8320855ecfb0c4a60628a02
SHA512 b9b62e5106057420acac1b36785e38654e07d61e90bb7e9df5a68fc14a63882e31260130667fec6552e0c2a67748c3071cf37375a0e0e7593040515570952339
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:JQvGAdlCEL8c/yRNw5CSLm
TLSH
T157267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6c108be5bea41bc78df0966c0363b5f5530223737fb744c2af61743d0a58fe16
MD5 aeef6d5c6cc169d8af648acd6429732b
SHA1 2920273afbe2f27b3dcc0388e92dd8bf90fb2382
SHA512 e17a918c780acfd731c16a8f6a15f12af912833eb82cdbfe11c97bb92ef16d1bf5c1d0795880acd8affa4c1180eb8190c93762dd1ab793dfee088bf4b7064d10
SSDEEP 12288:uAwSfxL/2Dc39DLLmt0LDQewsAjmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgD:TQewsAjGnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T19675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 118103ba871c83a578df583d942b663089b991d29eef124a68b82820ee49c7f8
MD5 a5092b8e6c821fa20e678727d132fd30
SHA1 d26196cefde035a76ff0a67400aafb664197c32f
SHA512 732c7afe0466e3ef4cb3289dc7c1899382007ea0c40c8a357aa2a359f220acf88af58336a3f9a8e94a0ac99e42ed4ba6f42da41d7c5be972c68bdfff6fd22549
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/zmQ/lFTjN4:JoqtVjnmGLm
TLSH
T1A3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 343931f4a15bb0e81de50181a3677e5b88dd3dfde8b455ec87b45efeb489d328
MD5 56ee8282e19a07c0f66fc09d0d57fa82
SHA1 da32bd8056065e56e0bb9e5efb2d507226630e62
SHA512 d65bad40892c020df2f7816b0c075f7bae808f4db90dfae51e467f237f2a84433543f7ee2a050b4cb93b66b8deeecd72233c18eef410bcdd555dde5c59953ed7
SSDEEP 12288:ymw5HEjsChN2BFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMT:rwuHOWqnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T15865F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 3b5660f34fee84ce4fee262a918123398751b3f147c921ef78f05e47ca7a0410
MD5 4b8eb31b46f86811c01f222c0735480e
SHA1 e4bc6cf2c31136496cd5beb659cf69ab10d23ab4
SHA512 edf391e86cc2c2bd000ca29d7bd0409246123295badfd7e3b77c436f6f91b00ad6f5bb3c0892f77ed8486082695691296ea3c8221d485d672ef4672ee6cb193a
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 88d12069d3bfa813dc37fa4d25dae56b61fab2c6f1d26eb2c37899b39ff4fd72
MD5 6bfba416fdd371d93167a8bd95cdac8c
SHA1 f1d0dd0e34cfe2f637b85f38288949f9ccbbfed2
SHA512 8d72e4e5bb6e3a132bd26c3f5fb5b98d37f655c05a6997c4b1f048b94616415c89933cc627b08d7ddec32955feeb621c8a5581c0d93ad84d5fefccf1d4cda89f
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:JQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T16F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 227a8f7b8b09ae5cc956783e916c8a6af5eefb17a34180b8f503b00c29422948
MD5 08b60d02fe31ebea014c0e2385e1d3e2
SHA1 c01a89e9ebbcea6c668f3ed24306b59f4a1fd76c
SHA512 4496ec4d400e592e49cee22adf2f64956308c42088cf784463c59c4864ff98d4dcd4950676ef8b1b9a48a861a6d8f39b9be5d6ca25fa75ac1477bb5410eb2364
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwQ/lFTjN4:lu6JmVxd2dDLm
TLSH
T132D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5712_13431845193413014.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5712_13431845193413014.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

680_13431845193362161.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\680_13431845193362161.pma
Size 696B
SHA256 dd732f971724c5936259d1b57b75fba75833fbf29c870fa9a4989d00cadc27a7
MD5 839694ac89b23a0b735a42fdd41d2356
SHA1 8a4a6536cb732f5ca1005629e5593b068874ff36
SHA512 62b1a7dd7139865bacf26d8938fc9b9eccfd1b580eb0a1a5011c7fb487728a4ee973e9bcb735ebf1b7d655229efb047b41a937aefb6c298d6f4ee8758b1340ee
TLSH
T124010E4AA3144FB7CC428D3584FE27552BB0FA502F821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e4ea5695f59f949060fda6d214d6c5e8c158c1cd637bc5d47e89ce23f1d5dfd1
MD5 7b2e80e6ffb99630e707e177b7095838
SHA1 63b56868f722c7aac8557f35252ac46450f920d0
SHA512 cc23beacf13e57adbd17977e40de848cda3ff33e4d1694fca346a4649f70efc898f54cea45c5a2b221752b420bdc919a462cc4e5b1215f1706530d46ddce9551
SSDEEP 24576:EcP4mcvIjkGOxhKP2l71nNKbrh/8KBTnQ/tbw/2Mkjy6Fr7g0oR:/P4m4IpOO67W8KdQ/lFTjN4
TLSH
T14665AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 f2afa6d0cf8fe3e2ae4189e27219f5215c314de8d62110ae94354ac548f70eed
MD5 3bbe0d0fadf86db16a9b879b99c0fba1
SHA1 c17e947f6a1573aaf264f2675698804a72eaa940
SHA512 a36948dfbf968d01dd3ee7522f245c8feb8aa112dfb63a8267488a4b5c112fa3036fab0952b5040017969a7768e074f3e19e36a5e9b118bc5724f2b8d99c903b
SSDEEP 96:yFaZ8WMrBsZ8gihK3BK302t3z0v0gihK2QK2tVkS4aQmH6/0:5KzBtuFczfi7bQmH68
TLSH
T11EF1B0AE8E42846F3B81DF2B336335A15D576009C7E8A4723FEBD505F0CA965011FAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 1419ef93bdbfe292b7a21be1b24c6dce5de89a6884c09fd1908f77d17b55a7ef
MD5 40a39fbca47e4f4bff86c1e215d729a8
SHA1 42ea2f9d43355f8187f97e051416bc1a43d9b542
SHA512 c1f47ebdd527376ce1cd647733b8ab4d86047654dd829482d4765334cd96123daa9674fe13ac6ccde6580a1720e2eb82f3be7929a87adccb446a7905ddeabe28
SSDEEP 96:yFaZ8WMrBsZ8gihK3BK302t3z0v0gihK2QK2tVkS4aQmH6/xt6W3hK3kK3980:5KzBtuFczfi7bQmH6H7oR
TLSH
T1AD12DEAA4E42856F3B81DF6B335335A15E576009D7E864723FEFD601F0CAA64001F9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 353a63127cd7c85fc19249e032b9e5ffa2ed5bdbdb5817390fb306d8cc33269b
MD5 fac1a92ef7479afe642a5cd454efdfe4
SHA1 e2acbad2ca07861407a1d10f359777970cf6216a
SHA512 7d17d75d1a830d3a1d1484d68f16c7730297268de76708b93cde3895295d8ebf62cd2cb9bcf79787dce6e05968ea4988c634af58370ba3da58c3c9e98fbb7a39
TLSH
T1DCE02BBAD975EC3758FD572C5040474AD74013573F50894F3A3C800ACFB973A158A81C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 50d89250911a354fa8e0e7fc7078152d498477a83c7e3e137d45a2c28f35ac02
MD5 134454c86d7519c4dd2be799a61fed28
SHA1 806135d3b0cf2c3f1d566f3f4d2f1c43e46a90a6
SHA512 88ce652bfa348b386f6d7e57c08559f4043f47187f6dbca078b6d9e702fc2b7ba165de88d608ba4dfdc89cdb97805aa01818b02012f95d7fd0ea6f54b5b0b461
TLSH
T15D518DF7D3D4866DC91156F49B256E2FCD2E0A28431C3C56C8D8AF5B93E2872D21168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f4a710b1d97bd2eaa3bc1ccbc2fd8fd30f0c249b0d6c73bf6e6924408bb0640e
MD5 7d16e163f91eeb782e053277cb971212
SHA1 3957609c5f1f0df49a566bf2fea173207ed43b48
SHA512 2ed48a4758c7a3f0c275b4469ed34c1fe77c05f59c5e50692edc2e8660e52ae064be4aa0ba409cf02ba4ce4c51fb532736632f0ae14384f8ba239f05d1676a9b
SSDEEP 192:LRElCK5iv7BWPRpDzTXsb+WNnPGTW42MZl2rRg64iyIsnAUgraJ:LREl7uOXjXwPIW42Mf2rR9e
TLSH
T19242B72DB918797B6CDBE219FE127A53D3F9202620D52E84DAFC852C14DF6CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 37de1325e76da74255f1db24941042fb875a26048310b355ceb90fd226a690fc
MD5 c2f2083a6dd8530a3766bac91dc04eba
SHA1 777a384d124ab9936b41ebd409df142a317ca376
SHA512 32ccee02fac68a79aecf62a08751d518ce05e7180223721d0b6ade7c071f286926cd3e5f31ee8b3e037e3d5f917963d531659e3544f76793ccf15ed41103724c
SSDEEP 192:LRElSiv7B9PRp2zTXsb+WNnPGTW42MWl2rRg66iyIsnAUgtaJ:LRElSubX8XwPIW42Me2rRn8
TLSH
T10132A52DAA28797B5CDBD21EEE227643D3F9102630D62E84DAF8852C14DF5CC222751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 da8a5396282781ec1cfa562935e76bf1da5d518e8e5258a083b7771ffec1b443
MD5 dd96efa0e2dcbca73ffad9e59fcde6ad
SHA1 b84d80e0baceb2e66bd3ec7fd28a4d606efa359b
SHA512 f5007bed0d15db657b76a7282cc161d81e8fadcff57f0656846135e71f270546a35005035decbf69508da240286abc7aeb16d39f8d8330981968b3db42313a8a
SSDEEP 192:LRElSiv7n9PRp2zTXsb+WNnPGTW42MWl2rRg66iyIsnAUgR:LRElSuZX8XwPIW42Me2rRnR
TLSH
T18A22952DAA28797B5CDBE22EEE227743D3F9102634D61E84D6F8852C14DF5CC222751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cb95ee5a968ecf7412a04bf32a0cd5cfdef48eddd5e8b804a37968d7c27260af
MD5 77d95e48f60e69ba820d57bf8271c311
SHA1 0dd5bfe17176c05157a542fa73b390258d9a42e0
SHA512 c5a95e64ed979b0cd9ef173602bfffa8a8e94ae655ec772a68b542661dc2a925ef34ba7d0ef63fe9832c2d6fd1bfdfabd0a1d1c2c759314442fbcf6e2c04a877
SSDEEP 192:LRElCK5iv7B9PRp2zTXsb+WNnPGTW42Mxl2rRg6miyIsnAUgraJ:LREl7ubX8XwPIW42MX2rRTe
TLSH
T18B32A72DBA18797B6CDBE21DEE127653D3F9202634C52E84DAF8852C15DF5CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58a6da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58a6da.TMP
Size 3KB
SHA256 1416953291c598b10371bf2f93fc3c242176d92ac627352f6bd284a3ef7bf26c
MD5 020164be0c6a0963df6f9985a767a83f
SHA1 c6497b589c2a01000c78c89ec490484370aa9347
SHA512 cb8baf498ee8eb30a1bc8a259d477b4c8b86c39cf6f255f1d33fb95d0f285d88852d95f4819d2a4e966551fced8afc15b7163a45a6b97341ff3e00089cda84b8
TLSH
T18261346DD5A04CA31DF2A77AB83A5F82FE15467B0140285639FE298C0F729674182F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 d3c154b5076656e3055c12db565bf75f1b4a2672c99fbdca5d7375c38526d35c
MD5 ccdfabd84cb061185e5a05d8191441cb
SHA1 1e4a08a8042a1bbc8c2c17b2cc5c122266e44375
SHA512 5c02658bb4aa54392d20c581609257fbb09597bc1ebe0ff293402e61040917f590e40ffc0cb601ea69aebbd46ee3c71b52853b0fd1c0d7e6916ee7f02a55a0d8
SSDEEP 6144:xEj/a7Vd+pbYgrP5qim7Rkm1tYpBeh2BAoR:xkm09nP5qN9oBGcAoR
TLSH
T1763423731D799D365F1DE71C640E3F1F1DF24C669D7E88914A842A0993EE3E80909EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 65175bcc0c7904a9a8a1ac9a0c397d873e6205e39139ebff697e7224e6447f1f
MD5 9efb0e5a75e3c8a4588d46e9bfd03a5e
SHA1 2acd6cbb4f3240313de424cdc5f99ba05d060b3d
SHA512 c110dda8259f522cd2b96a758e4e504b0b609f897c0f387c0c965b0e5bce357638d2ad2e48f7e6b251529e2b7b1e510830de7abe24718084b1000d3ba8ae2c48
SSDEEP 6144:21Dj/a7Vd+pbYgrP5qim7Rkm1tYpBeh2BAoR:6Hm09nP5qN9oBGcAoR
TLSH
T13F3412732C799C765F1DA70C640E3F1F0DF64CABDD3E98514A802A0966AE3E84909EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5c84773416b6d4668d5983fc5cd7811ddf667ed295ac7c26f14bda9a08d7a271
MD5 63c7b41c0327e749885afdbbb0134e65
SHA1 8f21f1d640550d8f4a7775cffc562440dc9ee0aa
SHA512 6b6c9a57f4c4111430fcf4843ef680aecf7d7e82d08c98f35389ecf433a86b2283aec3060151af808cf9243c4310ff1cfacc1fbb9c5d388cb4deb60b5a6052f7
SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:0m7Rkm1tYpBeh2BAoO
TLSH
T15BC3123B5D75E9375979A71EB48E0B1E1EF249A6C920DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 37f3cd43239758846b4535e2e2d03a39b30150beef3e5dd1bcaf4014b5a602a6
MD5 a876cc4fc5f04b8937af6ef42c23ab8e
SHA1 77c16f6d15cf2ae026670ecb40633992eb0f3ca7
SHA512 bbab96890bf8a31efdf454364d925f208d0f541c492586440e6cc7a3f43c30ad3a13807c799122527f2e0f246663d7b463e45c7012ed3e76ec6fe0334b27cf68
SSDEEP 3072:EwGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:E7m7Rkm1tYpBeh2BAor
TLSH
T11BC312376D75E83759B9B71EB04E0A1F1EF14DA7C920DE52C8D86B0423E97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

222cd75c-5f38-40c7-82cd-774f40643687.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_263258290\222cd75c-5f38-40c7-82cd-774f40643687.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4943450d79c0b0e8.bin

Path C:\Users\Admin\AppData\Roaming\4943450d79c0b0e8.bin
Size 12KB
SHA256 1b7f7ad496dc23b493261d3078ee51f4d811cc25c2760fe86eb50caaea4e6514
MD5 de853b840fc3097c36fa623d6d417c53
SHA1 840c134ece9ddb1fe1e5abc8ee9ef16c3aa0cd71
SHA512 f39ae70c2adb897fe7d8d3c108691611746463acdc8e9ee6bce6bd91e2cc04322f909374e7cd852c7b54df0dc953d54324445031bff75c6f79ffb5aca0ffe130
SSDEEP 192:cIodoSz+v1jKHqj3OvJArY2xsHwKkYzmqWuL2yf47NZfbVo+PBW6dib75EfD:cRoiHqjehAhxo7TLt4LfvW6dib7WD
TLSH
T13B42D06218D27CB914F0B7D2B27548B3DCEA55211DC66FFAA83885BE13DFA23254E14C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dca8ac9040feae6b0505f71433844ed4478c27be582ceeb354e2483598dacb83
MD5 2b3ba9262780971e718fd1fb0dff9c0b
SHA1 c7cfca8e686155ccd13e6cb4b066605f8e01d3eb
SHA512 3894f167fc3056f2912499e766800ec4cb467c70fe5255dcfd5ea4ba28a3593d2e4282c6cf0d60378c584e833c1166c38538ac3292a55ec3cb1bea396637f5c0
SSDEEP 12288:ZLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:Z7nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1695523296768F94BFA3B16B05892C151673F0EC5BF90D38FB708222D967C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 baecce7001a3fab4104ccf18528dd8be39f7b1799184ce8998f4cb3bdd15b068
MD5 c9f1db5e165161dc69b2845d4cedd771
SHA1 c5653f016f3c22a5d800a2c5f2b6dbdc941b1ddb
SHA512 254e2b9d3cc890b0c942fede078ea6c705d344a7f21216d6eb6f454af3616ad20301d76b4abae23f83a7edd3aff740cfbfdb763b32fe10c1ff3faf5a6143e790
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQJQ/lFTjN4:Ya0hNYG4JwJLm
TLSH
T197859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cff5f797d462daf27cd756a2e1606e49b5e294388de9c2075d501b2ef1983cd6
MD5 845bbbf0438c723aed65896e934b8e05
SHA1 81ff41ba7f9e358885cc7c3fd71fe5028dae881c
SHA512 ef246b914a9f9ac9e8319648a04bb3a9e9d0ff1ee583a3224e744a97c5da8b4e5b394b08770c4bda92976d3630e1705e7cfaccb0c64fd0656c3b16f7a8474d48
SSDEEP 12288:2hbHjfXiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:2hbHjPinQ/tbw/2Mkjy6Fr7g0op
TLSH
T13655027D26AC30DAF63692BD88928546D7327C552B11A3DF2385823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 42478a1b70f52779a8ebf866773dd8221ca6b4a6df56503705311fdd53e4d041
MD5 8d2feb7db26a9ab57b33bba5f51f2448
SHA1 5b171049bac5c0a38b3d4f3bbf3f62c0786a0b4a
SHA512 85a8da120e83d67b25f3a839cf13a86c8111d854b99c560bcc5381598c50b03ae696e1e4ff51da5108c689be304c6c7fd27015c51496ff5285d11f69b2dd0c1b
SSDEEP 24576:83YgnJcRTk4yti+R5dBR/qnQ/tbw/2Mkjy6Fr7g0ok:8IgnaTk46pBR/qQ/lFTjN4
TLSH
T1EE45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f70db9a106cd052452eed48023105c3134d75f3284ed5fff52880dc602818443
MD5 ee9016de6672cc35204c92c71de81bdb
SHA1 b0107a25f27f1a087548e3bef3694a634426fc83
SHA512 41537d7e4f312c9d33ed39403208f7e57430ed0251deba446c611dc03b2381cf2578f2c3a00af52a50d0ef0e2fc72ce4a5be8e87843d651fd642cb085b109229
SSDEEP 12288:MvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:MPnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1455523686618F98BFA2B06F54C838546673B0EC17B9193CF77482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 4f8351c9f8d419840f7e999b64bedc18bf3696dd04a35545fa16f3a4aa935b3c
MD5 0c54d2d5510b0a079c5339b92e056232
SHA1 89b78bfedd40dfb32988e09c4a46d09fc3af7980
SHA512 c478d5a1d9deaaf8b81ea164ef57629d5d266fce1b980b60d814ee4321d6bd910853ebafc55dbeaf14d0d2bc26c3d90dcad2c6d34a300fd3f79bc680c84e6b44
SSDEEP 12288:IOb4A4LWOsvAYFTgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:lwL3UTAnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T13575F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 aebcc63b4f3204e65c56103bd86622571ae2068f0f2f81735b27c6a051cf601e
MD5 ae5b75b8eb9f16f4bf1bbbcdf8a87c57
SHA1 7513cc5df62dc50cb7ae615e3faf3d8a5c69a6a8
SHA512 92d84011e9ba3cd4752716f816c8fe684fb04611b17f4c36c6736cc0bc6fe991c98a37204084f4ce04a44ae96219bb697e4a4d2a78f634354766977c7a8175ac
SSDEEP 12288:upFtCOEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWMJ:bOknQ/tbw/2Mkjy6Fr7g0oMJ
TLSH
T1DC55022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF85C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8ef7857ccb873752e13a6bcb578f2e7c0a0c9fac1e3cd34704597a08c44f9374
MD5 dcd9dca016ac0505342592782e24bf48
SHA1 9ab8ccc804a8df02db753acb28783125528e5fc3
SHA512 4e50e173c619bf1fdb8588bc5a485c806511423a16a7f121fb49ecf88c6350183cccfd36f16a75fd8aa8e05b86e8a5a9b2315e04231ff173fec2b08345d44863
SSDEEP 24576:c7NM9YqZqmWMUkPjZM48Mv6bEhsrnQ/tbw/2Mkjy6Fr7g0oe:c7cBWMpPjN8DbEhCQ/lFTjN4
TLSH
T13C659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ef0112119f766ce86c29129b8847c45c2a8d7fb685ae729c7085db66d0410b1b
MD5 be2afe76d407558596aae490a26686d3
SHA1 9a4d4c55aabe095433cc1d81247cf8725d2dd8d6
SHA512 7f5abdf40c2b63c6e120ed9f4c4427c098457b02aa87c6285f74bc8cc3f6664672db7251fbf821477882156e22065b19967d76f25cca3c728ffe571a81c19563
SSDEEP 24576:xW6BApg2YuyuNDYTabvcdvNYf8km11nQ/tbw/2Mkjy6Fr7g0oP:xF2YuHNETovAvNYf8kmLQ/lFTjN4
TLSH
T1B1857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 302b3079af9b6cd6b2e15b12d511664101f4bba631eab3b0a868010a166dd111
MD5 57743a5242aecb8de0c44a7efcad5d26
SHA1 90bf993f0fe9b71741901613f9dce1fc655347f7
SHA512 f379cfa92c474f02ab34af7be7e22a9ef4a452b733c9042efa12a384e1d357eac7aa5e3e14787f51cfac476ab504aec6b7cab1b37e95e435c7ad5402a97ecb96
SSDEEP 24576:UAFs06+Omlf3NXEbToYnQ/tbw/2Mkjy6Fr7g0ok:ZFs060lVXupQ/lFTjN4
TLSH
T1A765AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4b27f6d891b7bd90d3e6e93544aec8fb4abd0ca8686c690f6b923cdf57849215
MD5 14c90b0d345548c09ad99a69a5d3fde0
SHA1 e8624fd5bb364d39e328fcdcaed31e20f166ca9c
SHA512 61b1b23d1a2f0d8e1a5d7c2cc1b45bbd735036760286c1b3a9b87a3893fa2c8bd3837e9f12f825020dc331b32336aad11dd113221d4901a20dec911213fa6d52
SSDEEP 12288:4CJnJ5D3VkrqzxbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:tJnJ5D3WapnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T17475D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ed0ac6f7bc162e6f07dbc0c8d2c3b8fd1e324abfdc18a6cfb4df62487eb30cb7
MD5 c083bd4bd0dff43e89b90ba760286b8e
SHA1 3e0d9c800ec91291e9361a5a7ed81d6d6470c4f2
SHA512 7c8f967f0812d07621b82dfb59d41ec65cfb0a5bcba3fa4dcc3824248d96ea883fae762a3f6e641a8517ca28c70751bab042336edf899f7a84c2db0a6f6f902a
SSDEEP 24576:YEPghm6/7IIXdwcXrif7qQncjlP65i3VuqnQ/tbw/2Mkjy6Fr7g0oG:Xg06DIKdwc+eQnSt65aVHQ/lFTjN4
TLSH
T1C3955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ce744bd4eda7a3d3b176de95e07db81781bb7efc088c5e7c948a8166fd76075e
MD5 1d2dff326207fb95e633f5700679f663
SHA1 605713c886f368d60cbcb2cf624ed263d51987ca
SHA512 f7ef13f7c3a140f95c85d067c80cb1f277184871a506f065a5b172207717a5a959b178b880149fa643dd03c53b7211e07e83a87152253dbcfdd2390cf33ab423
SSDEEP 12288:eEP3RSGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:9SmnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B355126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ea8222816f4a1be8055e4e5515b45a29a87bd4a857da7bfc7a5d3e397269117d
MD5 ba22f70355b53e6c2c057338ca130674
SHA1 7b4468816edba3a197e62742931170d1c20515e1
SHA512 fad4bee15d0292eb703498b80e9b9ec91a4c60ad7ddd7997b1a3314075f9898c92ebc018481aa513c311d3416b1c88a26ef9911ca4ec68655084ec061e5ed7eb
SSDEEP 12288:jjkyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:jIyynQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1576512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e55221fc24e807696e8ebb0ca3f8b8cf56af0f02839b6b20ce75f79c88ae1ac6
MD5 9c109085131e88b6ba63b88e972340e9
SHA1 4cc96f30ddc9120a24b4d4feb20736044d814463
SHA512 d2950e87eae85892f4fbcc9986965eb2e2a89ac11dcc228ab47d7d57f8eaa70d85f62c22a9e29be31bc3c229533f00dbb7ef91b281b2f99ce57ae4ab6f314aaf
SSDEEP 12288:p0UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:G0nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1AA55236C2625F89BFE2706F448928542973A0DD17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 28f5651d33aea208e671488c2192faed46ce1d024cf0b5af987c6a15f239c834
MD5 53a3b438248ffc4da5b0a228e5cf2f2c
SHA1 cac40025448e32bc141248927978c027e114f710
SHA512 285691f3399497ab1dd0d63303b3172ec0be05f5c4a346123a4f42adcc2ddbc418225db2270f39a0dfc630c45a2e6c5d045526318f92f3a57a3dc983fc6fe3ab
SSDEEP 24576:eQ9MxZKdcz9dw3DnQ/tbw/2Mkjy6Fr7g0oN:eVKZDQ/lFTjN4
TLSH
T174558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 30103702c886e8c8734ffbb53b3c571862d35d1885b5430ba0e8fecebf163282
MD5 550fa9eadb482fde6ad991fa61fbcf39
SHA1 85eb66291a84e1ef974688d5114a7a66ad57a972
SHA512 a5286ecaaf42f6db44e99cabd7009d5c637acb1d372c73c67d991fc8f92123c885e54d43cd62981e2086ca694844cc433c84f93b323b4394b270aee5be75050f
SSDEEP 12288:TyoKo20Rple9pmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:TyocSApGnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T12265E01FBB6D90A2E136813C88818645E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 aedc881272bda9f60b505bb1f3e7257905def3d4f9e327dcb0e39af5acf04379
MD5 8b2b8f45cfeedf5ca5dbb80be6ef6ae8
SHA1 d08e6565f6a48e84f2ce27157baa8db4fb65e7ee
SHA512 9a048c13cc0caf686c792ff5bce5682b833d9ef5177ed8152c55c58a312709db055b6f4de76c5b023833f1d74a291435b42e1ce67bb81fd3d39f56b3c983a9ec
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKGQ/lFTjN4:b0zuNITLm
TLSH
T154A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5178ffc763ea24742bdc396093aef55b2b4a4a3b573ee6e2e77d61a12ac86098
MD5 381e2ba82370a355a36b98c80c63d56b
SHA1 d34a6c2c12b1e077b3bc1e6a28404ec9a534be89
SHA512 07ba7b7d38e7b6ca5479067387790a08d0ab6fce7a4da57769a831cb71d001245ffc23b045109e2a0ec6a099db4b31e185791be2bfa9372aaedbd1b9c158ce65
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYtjMqbtnQ/tbw/2Mkjy6Fr7g0o/:bTDxR+N5YzTfjMEQ/lFTjN4
TLSH
T17655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b8e891d7cfaade99d940540b9be849b0a7e7bda28d918b5357c88bc45a0771f7
MD5 efb3fb152ab5c186110ac41084df83a4
SHA1 b555f03507018129e7b29d669a33d5efc15cf7c4
SHA512 c0d7447decd42ff4fa50175c723558c04f46e8ed35a224cf21319ee71db35c90ae6f0dd242b702ca5269899a092af87c9e7e352e95a0250ccf6dd79dedd0d1f2
SSDEEP 24576:0TMdOz0FFS+1mSLhnQ/tbw/2Mkjy6Fr7g0o0:80K+1mSLhQ/lFTjN4
TLSH
T1F575E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 d44869b923faec542c02c9389ebabb264857c0823f3adaafe3f8081d166eadc1
MD5 513611cb23404e02714b338885097e33
SHA1 e420ea202aaeafc9947a702e8eb8d0fdab4243f4
SHA512 80ee68046d1981173c963ae33ce656caec0320a77125dbe2b10bf02c961fa9f1a5e6698c0688a3bef6a3b9e8dd58ebd046a8be1193cf58ff24a6f0b22c77f9fa
SSDEEP 12288:w4TgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:nAnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1DE55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-97-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/212-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/680-494-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/680-460-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/680-471-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/680-466-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/868-177-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/868-96-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1672-125-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1672-121-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1672-186-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1672-115-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1748-425-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1748-174-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1808-191-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1808-473-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1908-137-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1908-190-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1908-135-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/1908-130-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/2108-147-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2108-343-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2268-30-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2268-124-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2396-180-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2396-178-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3644-502-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3644-195-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3788-871-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3788-475-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3788-474-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3788-481-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3856-17-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3856-20-0x0000000140000000-0x00000001407F9000-memory.dmp

Download

memory/3856-11-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3856-111-0x0000000140000000-0x00000001407F9000-memory.dmp

Download

memory/3884-163-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3884-169-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3884-412-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3884-171-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4180-150-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4180-156-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4180-159-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4180-394-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4520-89-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4520-87-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4520-79-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4520-71-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4520-77-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4540-194-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4540-140-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4556-454-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4556-183-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4600-6-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4600-1-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4600-27-0x0000000140000000-0x00000001407F9000-memory.dmp

Download

memory/4600-10-0x0000000140000000-0x00000001407F9000-memory.dmp

Download

memory/4840-187-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4840-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4864-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4864-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4864-68-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4864-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5024-40-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5024-43-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5024-34-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5036-109-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5036-112-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5036-182-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5052-199-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5052-143-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5052-503-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5144-869-0x000000000CF40000-0x000000000CF48000-memory.dmp

Download

memory/5144-247-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5144-515-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5144-226-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5144-210-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5144-200-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5680-887-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-876-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-874-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-890-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-891-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-892-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-895-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-894-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-893-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-897-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-898-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-899-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-902-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-905-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-904-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-903-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-901-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-900-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-896-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-875-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-914-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-889-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-877-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-888-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-878-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-879-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-880-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-881-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-882-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-883-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-884-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-885-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5680-886-0x000001C681990000-0x000001C6819A0000-memory.dmp

Download

memory/5712-443-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5712-440-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5712-500-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5776-446-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5776-452-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5776-456-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5776-868-0x0000000140000000-0x00000001406BA000-memory.dmp

Download