ead0c43115d17be8d0529074744a4a7838538380c5414154290b09e6d9c5a2ba

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 5.4MB
Sample260823-k2edeshg95
SHA256 ead0c43115d17be8d0529074744a4a7838538380c5414154290b09e6d9c5a2ba
MD5 46d6a8ce260ec8ff5d2d61daf0b2a009
SHA1 a2fbcc2346117cc24f2ec44aeabf9416a0bf5d48
SHA512 9ecf6be37107c52cc7a30f3bdef6d2a46e638c87a41e0371786f94ce01d5ca63c592aa93655ad70395e48e5bf135960e8d2e398dd0527cb4c86c1ab08debebab
SSDEEP 49152:J0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLX:5wfhY7g/rLO7yYA3awr341ggUf
TLSH
T10D468C13F3F501E8E05ED9B49BB9673299757C9B8B30A2DF059836251E72ED01B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4820	elevation_service.exe
4244	elevation_service.exe
1240	maintenanceservice.exe
2828	OSE.EXE
2396	PerceptionSimulationService.exe
1148	perfhost.exe
4828	ReFsDedupSvc.exe
4924	SensorDataService.exe
4960	ssh-agent.exe
4304	AgentService.exe
3452	SearchIndexer.exe
1956	chrmstp.exe
1660	chrmstp.exe
5148	chrmstp.exe
4344	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fd92aff2209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3180	chrome.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000141e969bde32dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0a2359dde32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001373c8d9de32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c903cdd9de32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f30c469ede32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319495527564199"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cb3c109ede32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1400	chrome.exe
1400	chrome.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
7024	chrome.exe
7024	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1852	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4304	AgentService.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: 33	3452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeDebugPrivilege	4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4648	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4648	1852	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	89
PID 1852 wrote to memory of 1400	1852	2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	90
PID 1400 wrote to memory of 4232	1400	chrome.exe	91
PID 1400 wrote to memory of 3180	1400	chrome.exe	103
PID 1400 wrote to memory of 788	1400	chrome.exe	104
PID 1400 wrote to memory of 788	1400	chrome.exe	104
PID 1400 wrote to memory of 612	1400	chrome.exe	105
PID 1400 wrote to memory of 612	1400	chrome.exe	105
PID 3452 wrote to memory of 3592	3452	SearchIndexer.exe	106
PID 1400 wrote to memory of 3924	1400	chrome.exe	107
PID 1400 wrote to memory of 3924	1400	chrome.exe	107
PID 1400 wrote to memory of 4364	1400	chrome.exe	108
PID 1400 wrote to memory of 4364	1400	chrome.exe	108
PID 1400 wrote to memory of 352	1400	chrome.exe	110
PID 1400 wrote to memory of 352	1400	chrome.exe	110
PID 1400 wrote to memory of 4580	1400	chrome.exe	111
PID 1400 wrote to memory of 4580	1400	chrome.exe	111
PID 3452 wrote to memory of 4548	3452	SearchIndexer.exe	112
PID 1400 wrote to memory of 2820	1400	chrome.exe	140
PID 1400 wrote to memory of 904	1400	chrome.exe	116
PID 1400 wrote to memory of 904	1400	chrome.exe	116
PID 1400 wrote to memory of 2352	1400	chrome.exe	117
PID 1400 wrote to memory of 2352	1400	chrome.exe	117
PID 1400 wrote to memory of 1956	1400	chrome.exe	118
PID 1956 wrote to memory of 1660	1956	chrmstp.exe	119
PID 1956 wrote to memory of 5148	1956	chrmstp.exe	120
PID 5148 wrote to memory of 4344	5148	chrmstp.exe	121
PID 1400 wrote to memory of 1540	1400	chrome.exe	122
PID 1400 wrote to memory of 1904	1400	chrome.exe	123
PID 1400 wrote to memory of 756	1400	chrome.exe	124
PID 1400 wrote to memory of 5776	1400	chrome.exe	125
PID 1400 wrote to memory of 1540	1400	chrome.exe	122
PID 1400 wrote to memory of 1904	1400	chrome.exe	123
PID 1400 wrote to memory of 756	1400	chrome.exe	124
PID 1400 wrote to memory of 5776	1400	chrome.exe	125
PID 1400 wrote to memory of 3740	1400	chrome.exe	127
PID 1400 wrote to memory of 3740	1400	chrome.exe	127
PID 1400 wrote to memory of 5588	1400	chrome.exe	129
PID 1400 wrote to memory of 5588	1400	chrome.exe	129
PID 3452 wrote to memory of 1656	3452	SearchIndexer.exe	130
PID 3452 wrote to memory of 5508	3452	SearchIndexer.exe	132
PID 1400 wrote to memory of 2000	1400	chrome.exe	133
PID 1400 wrote to memory of 2936	1400	chrome.exe	134
PID 1400 wrote to memory of 2000	1400	chrome.exe	133
PID 1400 wrote to memory of 2936	1400	chrome.exe	134
PID 1400 wrote to memory of 4640	1400	chrome.exe	135
PID 1400 wrote to memory of 4640	1400	chrome.exe	135
PID 1400 wrote to memory of 2980	1400	chrome.exe	136
PID 1400 wrote to memory of 2980	1400	chrome.exe	136
PID 1400 wrote to memory of 4800	1400	chrome.exe	137
PID 1400 wrote to memory of 4800	1400	chrome.exe	137
PID 1400 wrote to memory of 5340	1400	chrome.exe	138
PID 1400 wrote to memory of 5340	1400	chrome.exe	138
PID 1400 wrote to memory of 4304	1400	chrome.exe	139
PID 1400 wrote to memory of 4304	1400	chrome.exe	139
PID 1400 wrote to memory of 2820	1400	chrome.exe	140
PID 1400 wrote to memory of 2820	1400	chrome.exe	140
PID 1400 wrote to memory of 6648	1400	chrome.exe	141
PID 1400 wrote to memory of 6648	1400	chrome.exe	141
PID 1400 wrote to memory of 1536	1400	chrome.exe	143
PID 1400 wrote to memory of 2572	1400	chrome.exe	144
PID 1400 wrote to memory of 1984	1400	chrome.exe	145
PID 1400 wrote to memory of 7024	1400	chrome.exe	146
PID 3452 wrote to memory of 7048	3452	SearchIndexer.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-22_46d6a8ce260ec8ff5d2d61daf0b2a009_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x310,0x314,0x320,0x31c,0x324,0x14044ae48,0x14044ae58,0x14044ae68
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8b80ac728,0x7ff8b80ac734,0x7ff8b80ac740
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,13190714773783779516,7208738658950044600,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,162771154083480063,18406879224864093017,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
    3⤵
    PID:788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,7709384113600070759,2345623833120270767,262144 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,15633098383357445043,8772603654704424452,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,17593620545019344980,2700517959761987069,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,12550448874379108854,16854693558671487578,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,13300422481031695186,17744706706630922213,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,6019322857062665990,4312900240221201764,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4924,i,17506105093573047980,11363133870581914983,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3964,i,9625444740573991535,14703662341090923552,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x304,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1660
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5776,i,311829512346359008,6133694147582672705,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5656,i,12278373595669991223,5667050795547677807,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,1158708798446950973,15369317740625684297,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,1778578055049655997,18204392105754894727,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5560,i,10605463261259604231,15785708768793534514,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:3740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6808,i,7682714104923812714,18112000902716988011,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5808,i,18264109039829019500,13000714669739880235,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6324,i,2167351172630533627,18351108528734103033,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,1774853201506438550,8139255350938818640,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,15780694140060980135,808638526491347255,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
    3⤵
    PID:2980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,11210419947339406923,1090713658603270187,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6704,i,11261904297064404140,16442772547964232408,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6576,i,6646041664369590308,3686570791587304807,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6516,i,9997376938817380136,18334734329043235863,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:9
    3⤵
    PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6092,i,10709783313060802490,2690216872959858400,2097152 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:9
    3⤵
    PID:6648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,5226083505671205188,10274565507371259382,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,1349211445682354295,10313939189941035827,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,7640284816822253759,11200958888481919118,524288 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6196,i,8430266929606401203,14612897226031772310,262144 --field-trial-handle=2284,i,12738532588449204334,11120786908464728520,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:7092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:7144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 674f55863547cc5d45f2b90993dd2f101de3bd5a49a4bb72f8183fe03b8a6a0f
MD5 8b187d436174deb1a548f70baa9c35c1
SHA1 356f4c8a70b4a7e367336425c4778208aed212bd
SHA512 f6ecd55f36ba36306592690c885054d24728672624d7cf0874c8404ac4b86ba5debc1255c163e5802c7663d9151a88dfd77b0fcaac001e5548ee8aef1aa3e2ad
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYgFIDRRAubt5M:G3q6sjBKUf
TLSH
T1B9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 812e793e126d9b2e3d7c6bc3303b34c6740951c1afe7882073716129322c5cb3
MD5 c80defa278e1c6792a8f859f7d94aefb
SHA1 60e7a66d2b5a052100a77ba25dd9c72413613e17
SHA512 35ef931fddb182b4a88bef4479267f63999b22c6d1c373ce687bc8d1f33aaa26c25efd1be9b7429f7f016b6a68040a0a607319f0b3eec11fda93fab63fbac7fa
SSDEEP 24576:1XYfDtczArVg9N9JMlDlfjRiVuVsWt5MJMs:gtcegFIDRRAubt5M
TLSH
T14B85F12873D509F9EC678279C9B28502DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4ad6fe20c9a1d1c2d2ff04dae137ee60ce2982d56e2e6d16c39139c403d16467
MD5 3e9b4079e7b7e771b2a871e489de24e6
SHA1 d8167c6ef9ce6948a3c687e9b0fefc9cc09b9676
SHA512 bc20f32b030936d390a54329da199c55e607ccc4a7a0243a6f0e704b86d826d4cbd8efaac89261630b0e8e037aa5358d734d7fa8d2f825a1037773265dc87e59
SSDEEP 24576:U0Le5ji0hmx7rMwVg9N9JMlDlfjRiVuVsWt5MJMs:UPji0A5DgFIDRRAubt5M
TLSH
T11B959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5b292e652af65d9efdda555b24d9f51371a4cc2ab377baa4f71e94ff3c084f1
MD5 3414a5892016e19362d10f3a3ee792b9
SHA1 842e73a9d74513668ad029914cd4fb1b93e204f1
SHA512 76fc931c12782f0272446e349b073521553b47db26bb85b313e163db7467ceccdc92952856dc974e79f23e171dfb935a8ea5828f56db60056b4888f6bc64ca45
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyuiVg9N9JMlDlfjRiVuVsWt5MJMs:N/ezSC6vUzPveHjy/gFIDRRAubt5M
TLSH
T101755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2cd7ebef6d522a37b5d6bd93b19e7849fdd3234985f5c434f965bc014183b822
MD5 ec27f016e531e2973cbc84864693db08
SHA1 b3a35995716e46648311ae7ea1539748115e1460
SHA512 4c204d8abd8b874cedff2904cb23aad957495fa5393ba405a4f29d49cf8311ed52112b25d4c6ca11aaabfd7459f8b47d52f78b4ce5498b44b2e9a4e8bca1a13a
SSDEEP 24576:hVbqPb88hv/l+YPVg9N9JMlDlfjRiVuVsWt5MJMs:hVO88hXl+mgFIDRRAubt5M
TLSH
T1C5559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 cce3bb9182a161f2cdddd067bb4ceb4347a2dccfdd045a3f5f62b161598d4b27
MD5 88e5481178af9679a4c440704020a9b0
SHA1 b08d31b767dbe434edae6f8e1184573e72e42636
SHA512 eeacf53a2a51ca55d1787d0d14499e25b1bede9d54dcbde0b5d054f8d30208788bed92827b4c1b6e4ac0bfaaf24df0b360239f543f8b6d3e62df036fc621beeb
SSDEEP 24576:ywuWOWFVg9N9JMlDlfjRiVuVsWt5MJMs:ywZO2gFIDRRAubt5M
TLSH
T1B285F14A32A40CF9E9678239C553C236EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99d8e001323282ad2e0c91cc520dae3153521507a59c292668bc17ca43f9923d
MD5 6d22f515a8432a4eee69ace7712463a3
SHA1 da405a727dac23f8b93cbba9256cc43ae665cd10
SHA512 9c3cd5bab4250e881285ab2329c701e4af6feda2b2a150a3587495fe0af310e33049c9ca718332ae333453e6561effddcb39335f10fbe180341494dfc5fa9ab1
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:uQRQyi36YOcPbLvw2gAf+PN3GUf
TLSH
T11B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 82a7eba7b4d6ba6dd0fd51b2673c6f22db9995b1d98c679128678f0b8db280b6
MD5 03727c70b82468cf7f596c903f59977a
SHA1 cd61753f70e9693b69f79012238fe542b6ee5474
SHA512 ff01bfec58f065357ce64d3ac662234ab8bb1c6120d4ff7108e8d47b593299b8b172d159cfe5d35f2195a5a8e7728251dd99cb1d77d3948c3e00d4483cc4674d
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glqgFIDRRAubt5M:7u6Jmdxd2dTUf
TLSH
T196D59E13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1956_13431949551915739.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1956_13431949551915739.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5148_13431949551880887.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5148_13431949551880887.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 3dcfeb1acfe6151ac95ee57a5c2bf2102bee5b97029fceb9993f884acb9f67ec
MD5 466509c9329b24368cadd66e56bd86b0
SHA1 b7fb63f74344278e26bc72ec88f3ff0d4c0d3661
SHA512 d142f49c073eac617ab08d2d04b479a4c829a997387a132fc5d1ad7acc2720cb301831334ad12e3b68c7ba49bb0b0dae04eeb3f269ddfea3da8a1df75e624aeb
SSDEEP 24576:zfwv2k9RX6wkyAIEVg9N9JMlDlfjRiVuVsWt5MJMs:rMnYIEgFIDRRAubt5M
TLSH
T19D95DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3dcb99363cd8bc23a8c3e6a4544980a5d5ab61dd9902f38691b18f65eabb5490
MD5 aaf0b5a6882b7a45adf532ccb3e013fe
SHA1 69fac463d10fb6c45a359269634c7628a8e05007
SHA512 096812319c626de93fa368b33824a16d3a3e66e5b359a69315c94da38b932e36c2f78b0d72ab742639cbb52aca3e4afa2d29c5df241791ba269a2bf938a4c5af
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05gFIDRRAubt5M:tySzPmUf
TLSH
T184066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 126de9c777e2c47139aad2256b870f9637347745a7b05129b6c554290605debd
MD5 d58c5e7921c9edd02f1f840f6254e2e4
SHA1 29643952ca398839f3d7d01ee1b49334fa460bf5
SHA512 ccaff03bcfbd03810b4d96e0f22823dea994deb94b4099e58bc1f63fa3319e4650168643a17a77dde4d07a7b67a9035d1dfb1cb145ce11617d8189dd880f5832
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYNVg9N9JMlDlfjRiVuVsWt5MJMs:U47JUQjTirIhCnDHUPfF/pgFIDRRAubE
TLSH
T14765AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a0b35dd11ccf62544e264f6b4aa50f88a74d25bed7710cceffd1840e7475dc78
MD5 70bf397522ef1f7fb65bccdc84483b17
SHA1 2091e2ee37fed23b023c5641d75a66992b0b8022
SHA512 1d7523d89fa5d756218bfd76d34a0bf96544105f068f5b953891145c9e79620e5b34c4fb442d2e7d36cfdbcaa67b80fd97e11ae1701bf599c12a6459e05da1f0
SSDEEP 12288:K2kIU3fYEVCWSCYWpVv1jsYZu2kf+3geGN/SGU:K2FUPSWSngR14JJ23g7N/SGU
TLSH
T1DE453941766BC75FC6A940325E32D6CCA7703D01EE04AF0773C8873F9576669BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f42f30a46ce0c7058141871cc2e8896e37f7469a2ae37e27976666a710f4d653
MD5 dc8cd14ebdf47f1ce594f15b69fd6b3e
SHA1 8eaa4251f47f8ecff57ab5e8e6c8f85483684fd9
SHA512 33163b2d5fdc14635c5b717bee8b7ffae6293d30b225121e8eeca38dbb8b3789b4350daffe93b015b3a090252272e5b9be47a38b00581ff385dd0194e6af1c01
SSDEEP 6144:E4TtQu1mUfEVEKzUhpUiviRh9bEwZR1tMxEjGTeNN675vg2a5QR1tMxKGk3ULKSm:LFF8SK8udTjjGTeNN675vg2a5L7opVz
TLSH
T138650A816437E38FC1FA503203266B8CE7B4EC17B7056F26B398453AD866725B5B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f96467cc76ded029506471a02f78cafe26b8a65a799a3914265b1f5c0497b5a2
MD5 eb46038d9fb86bd59ec05f0963f3d282
SHA1 36938b8681fbe531eecdf9587e3fc1d6ea1fd1a6
SHA512 27c25b50ef70fb6c8461e8895a524b826a19c3360678625cdae215e26650d4d1d83e65e39b26ce59818711ccd12c318fb91c7ad39525809491ddf04982641c99
MD5 SHA1 SHA512

Submit Download

9a8553bc-13d5-4424-a646-70ad69d26d3a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9a8553bc-13d5-4424-a646-70ad69d26d3a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e18d9d0df5960e2f75324f85f9ca1598a6a25ac27090b7dd85e544d02cdda71b
MD5 0945930c916216b4ab44984c92d82b38
SHA1 5788af1828c5b6f3e4166a011068053a093dc3ff
SHA512 ee4f98a8f5c08b4a6c1ce7ea7032fd19c4b15e20125b23f8bf3decc2df0972326862ea3d2b475693dd6fac913f82ac01f031f0b9bbca0996e3d8920544f6709a
TLSH
T13851BBB7C3D88A6D881152F89B257E1FDD390A24421D3C5288E4AF5F53F6972E20178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e0c352caa11b51dc7e7d080effb156a91201ac04d8073df0f964eac6ff745e3e
MD5 dfd47f6e59ed3d54d87ae5604fdc21c8
SHA1 399479325c45aeca38c666d3dbb647c8011e75dc
SHA512 977002ca83dab18a28b51ba09f9bc9bc3d43bb539c2b4f174fa89acd7b60eff2ea249f347a5c4b7501ac97c97bf076eeca637076509dbe391f7926a336c63715
SSDEEP 192:rRpWdziv7qvAPRp2gXsb+WNncT2q6ydfwTjiyIsnAUgR:rRpWdzu26XDXwI2qddPR
TLSH
T1F632C62DAA90793B5CDBD229EE21BB53D7F5007120E71E84EAFC852C15E76CC222B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d4db9c41f6f3ec4e9d03d386032f8f3ba1e7bee786c6b03d58214d98670e6079
MD5 35eb3aefd992e3af12c20801c8e7c3e6
SHA1 435abdb6dfc8943919bd8e3a0e7c9d4cc736a2ea
SHA512 f0dbf62432c88f1d55e602b091190cd3e8016a4b241e0a364402b2f7acebf3515a519122ffe02e096f9649e9e969845a01214b136dfec83c7718c4ef1c8ac0d5
SSDEEP 192:rRpWdziv7qpAPRp2gXsb+WNncT2q6ydfwTjiyIsnAUge:rRpWdzu2UXDXwI2qddPe
TLSH
T17432C62DAA90793B5CDBD229EE25BB53D7F5107120E71E84EAFC942C15EB5CC222B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 701de2bb88acb117ca4d30e17b42348d67833ce98ea39b59913f28234e4e3c52
MD5 6d4b1215f72fbc940dcb434142598881
SHA1 4022ad9447ac02bff6d6df3e81dce8d3c840b575
SHA512 9d5b56cd71ff5bb5b5f7d5ab0a75d37b8ec6d7a0e801429b5346c68f53681442bff0d4580cf34f9c949c517d2bfe46656b6a3e9715eb55ae6d4ca4b2938616d9
SSDEEP 192:rRpWdQU/aiv7qpAPRp2gXsb+WNncT2q+ydfwTjiyIsnAUgE:rRpWdBSu2UXDXwI2qZdPE
TLSH
T1BC42D62DA980793B5CDBE229FD25BB53E7F5107120D61E84EAFC852C16EB6CD221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599f15.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe599f15.TMP
Size 3KB
SHA256 af2a2cf045da381443ea35533bfbe98e68a998c91f5080adce3f5f539ac7d5a3
MD5 1a5538503e50ae98b2ca5b6cc993d726
SHA1 082982418712c7e799d7be65100ee0a86ed2d0bb
SHA512 379f03b8b14ed0c38e2f0cbc7847cc1e93a57d226d67e3a298d647a7efa97ff11f536edd76a2231413f134abbc11fa030d0af32c8f10d7c6585f251407e89002
TLSH
T19E6153AEC4685C970CB2BB75787A0782FD61463F4595280A3A7D19CC0FB7DA74084FAB
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 27192f91ec820955495b1f94685ffc0a1b8e8f7acb7788ad4690b68f797d1047
MD5 f7b5f01ed6c61f2b617fd296f6a218e2
SHA1 ad146dec92757a82ec33eb0a21872dde72fbe59b
SHA512 e91372958a7062c1d200867593c807905db0e927c12d587ad4fca7bb0066cb7e0c27327d8de835e9ddb3d92aeb54dda5739e150bc589323621bcc54caf900a34
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEBPRXzKD/8E+d+ErUkKN9S7vNN:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsl0RT
TLSH
T1B532C927A48D9E3F4FD8D50DDC12AF8BADF4429662780C2497FB5D0803A57CA114B5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2d84cb328823c76e09cb8b687a7010a4b1b9f40532fe3dded44529ec2ed109c5
MD5 ba0f35a211f91f67043ee31854efddf4
SHA1 5b43b3ecc12c1ca423bede95f35db2bb4ace37ff
SHA512 b6e758c045b162de0d36a4610b205abeba37fd1eb1dc6d2fd3f031e38909f0dfedd064917f0b396404e812b7d86dfd3c8e4046c121973c25ba9025ba28ec4970
TLSH
T1FAB01284C0461701C80041F1154A104573599F27D4000F438AD1DF85AD930F44253115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6fc81275606c740c4b424d65907e0a866ef43b2c8a0dd3021bdda04f7d645b05
MD5 d6eff165ee377afb81c53e3848931679
SHA1 b501c793105c94190dadd9f2dfc7f21992bc4b4d
SHA512 cbd2c2278e18c91c6233782bed64ba8fc99846350b620d1267dcc76a3e2228b13b2b4e0322fe08c4b2ba2c90ee6311994c4e098f29effd13f3620e70458e8015
TLSH
T14FA0021082D50553CE4046B6716306463363C86D2961678394D917978B5B2C85B11706
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1500.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a1500.TMP
Size 48B
SHA256 e14793ce03b6e43a02d5e3dd28a46d09442c82180c1902ea86adfa9b4da1c2a6
MD5 2c9a709e9dc59981bf64d5106577ddfb
SHA1 b70f49daa760af830140b92cc6785eec523a863d
SHA512 c9efdd16bb4635627797082b12d1fe9b026e0332826e7c1ce767a7e292ae9126575eb743fafe039000101b5336cb59b4efa39494615e46c2eaa8056eee09367d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ba7f30f3794f241cbcc18f229526cf5d24633b61b35f3f5ebcd2275a7e71a179
MD5 5271b6873dfaba310163440cdde5e6fe
SHA1 5a143e2ee7d71859a67b946f49e232b587f1160d
SHA512 35ab42336d771d1b80ccf872fc5d582077ae20f5b7094577a99cb1ff4ec0bc71d037f3482abb1c8476d4903c54a4527216e7f8913312a0cb3db9279af40704d7
SSDEEP 3072:G5PoycZ4g6S3l7D31LSMkdhnMCO131x8LL:G5PoycD6S3l/31Xksp91xE
TLSH
T13CD312707478DA5E4F7BD158806F280ACC67D0879D1EB97DAFEA9EC950864D803372A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 2a8374618b644129b0d1be610ef0336f39700feec2c8be8af7e33124d3d67cae
MD5 a4bf57694a5a0ea78751afed79dfb960
SHA1 15e70b2a4bf00077aeb8c94afb0adc260d35054e
SHA512 29b2230f6844a4028c26c4b988d0e9ec2ada551718cb0b449588b16f2d0326a4358bb4f38f94938a116fd818c13712daf072d8d7086707f1751acbbab5f67a63
SSDEEP 3072:Y05PoycZ4g6S3l7D31LSMkdhnMCO131x8LL:Y05PoycD6S3l/31Xksp91xE
TLSH
T16AD3125074BCDE6E4F6BC568806F240BC857C046891AB9BD9FEB9EC960D64E503373A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e5ef977641bb472958b6913fe9a0102d29a33cad7cd0a63cb890609e2f15220e
MD5 b9d329703e3214f389515eaf731be783
SHA1 523623c0f6268baf7b6a2390bc3bf82ec50135f9
SHA512 d0c370d8ff0b1f64ea8daba54da8e28d2b1c26fbfe4a6b925797c88de920c6fde0132801e3ea35da56408347c3b301b23f6e060b294881a0709b4b9cb5bef72c
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5LlDfB60GyvnnXJlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDRpECXJlbK7
TLSH
T118A12B72A4698DB35976E549B9622A03CFB4E16B9D229F54D9DD0F0C00FB0D81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6c57a4779cb62d4939316fae866044c449bfc3844b541b5ac5dfbbb2d35ba1f4
MD5 e845352849a166284199ead68cabdcc6
SHA1 0389fb1e25f097d558750d92e6e9e63f2551f056
SHA512 4286a31fecdf9c63a9b120bf2b02dfe10794370bd1465cd93aa85ebf8203d474e5aa01666ffce4465b2d5b5f1b35ecb6622a102ba994e1944f34575107927899
SSDEEP 3072:X05PoycZ4g6S3l7D31LSMkdhnMCO131x8LL:X05PoycD6S3l/31Xksp91xE
TLSH
T1C1D3125074BCDE6E4F6BC568806F240BC857C046891AB9BD9FEB9EC960D64E503373A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1400_145024606\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

fd92aff2209659e8.bin

Path C:\Users\Admin\AppData\Roaming\fd92aff2209659e8.bin
Size 12KB
SHA256 7174fc1a4e423664f98f59bb79f20fec6cbf173ff9caf2299bfa94cbc1dd0b71
MD5 04dfd867c0652d86bae48e11cc897702
SHA1 410355c5d88101e2add190f0da733483dc5fc19f
SHA512 f9e5ba07d68a43aed4215c6317de2e0f5603279ea6c224593a1765b0e6f91bd221d928ce1da5d4974f1aac1a2e175c75e84fdc47882d5c5dae0c5e150d212767
SSDEEP 384:6QiWVCeTSGpB0JtaINSP94K/GxkKsBxHw9+Qrh:PTT/pB0J/NqmKOxkKiHw9dh
TLSH
T13042B0A56276E45A40719CA9C878F903F1B97FC815AFB303DD143D8C90D5C8A97226FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c178497a02e4b099acc85e2329488177f5887af41af010ddec3c3dd42196fdbd
MD5 7ac5e5653b7b884f5e0d32e71486eaf0
SHA1 da85f69fc705d74556223635218824fdbb51fa13
SHA512 ed1db679aea82add3b1614fc9b872adb70f958da2064bc539e64afb266a5720cce158d5d304d5b66d9cd11826642060aeae68476f1ab9fc5950a978c57d0fb20
SSDEEP 12288:F+7sV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:gQVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12C65237A768999E7D46B92B0C97383058B2B7B693B8181C7E17005D199F81D1AC3BFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd2d970444b4b4afcf5707ad47f9a7be7f2f5c466799b37dea117c59f34b43ee
MD5 d7b1f1f532fee91d1b66d1330b7db0dc
SHA1 f475e4342d746b1a2520bff94ed5c519bf54229d
SHA512 31f8a00c1780317fa14bd6a8929dd8b8c8bf378192a7af6ab6121edb8f37973271c1188f34e8f3a0832af3a08418a358824305378bd3bd37bdc155142f3435cc
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYiVg9N9JMlDlfjRiVuVsWt5MJMs:3gb4mBIBhGFngFIDRRAubt5M
TLSH
T10F659E1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6051e3705678dfbc7af0925e6dfab2eb3500b51cde126dc1fb9e06fd664d7410
MD5 9db0ebdc0f7643d73979cf05382356c7
SHA1 2361167cfd78e3d62bfc172c40ec36906d0e38ad
SHA512 ae44b5343118609e601e8b393616f352f06bb54c99332c0236088af9f7100c5c92b43b992e41aad7059ae95e153c9b4f602eb0008ed856f900eccc7601f3a6cf
SSDEEP 24576:SG88u8FpJqH19zria7/mdVg9N9JMlDlfjRiVuVsWt5MJMs:J7ZFPqVka7/mgFIDRRAubt5M
TLSH
T1B895F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F236E14B3FF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be1127aef53d591ed70b1b587102d80e6b375a4ffb669537c78ab6b48208a88b
MD5 abf00c649ae7a2d10785a0ac1156e2cd
SHA1 8247cfb9a9e7926c6ddd1e173ab467fc1b57e901
SHA512 b04d85597d6f34fa8955ce45cf462d79b2290240c466d0ac4962089b78b863d01ee07be668189ec9d408761ada6c01acfad425ccefb6136574f889bb61ab4b4a
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7gFIDRRAubt5M:jG05lO43bRUf
TLSH
T170D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4865d36188f568ff04626ff77284839ad784f5432fe25925d5820286dca17cce
MD5 54d2b7ab613850f51f080e6be62da67e
SHA1 881f4bfef6590e5c1eae2e39c91e435aea572bb4
SHA512 cd33cec102d410f40807b98af8a9799001e2b56d77ae2ff0cb56fc34b08a03bccf7e86da37c0688351d536cf7ab8cc904a0ecc1f79f29c3b039842fa3ecb5325
SSDEEP 24576:Qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnLVg9N9JMlDlfjRiVuVsWt5MJMs:oa5POZ3BJt2pasx2+mDgFIDRRAubt5M
TLSH
T1C565BF5EA6FC01D5D579D17DC583860AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fd2b37d845916cc6e35a3496e13ff68496541b7bd49b19c9f2349eb66f36c89a
MD5 28fc47bd516974f6f7a1bafa264122de
SHA1 247b4ca4d9d75c02ba290d27232f6aea5b68926b
SHA512 35cef7ada3d6cf285168608db3777832595deecbd83d1a66384baa07b2cb863d06deb3b8b98acad873c97066d5c980360484ed67c873eb767e02c09eb12f99c9
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FklVg9N9JMlDlfjRiVuVsWt5MJMs:oNc/zEOVHFGgFIDRRAubt5M
TLSH
T105858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 a048e1535e30da74cb7e6e78c1f6aa26539095310a91ab26d04af7563f4d8af5
MD5 ff1c488c2cccf4a3dffc1333c85cfc83
SHA1 0090a8cdd41e1472840d7d2ccc80a954224cd8fe
SHA512 89dd364de04caca621785d3c1e61f2701a3480672e74778f0449cb1b36cc2edb44b2a1d9fa6b48a177ec46a3100c813fd3a32a96641a5cf4fa7a74a7819ed595
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 dd239c3fed7ba11d64d76508675d0309920825095ac0439b52a766487b66462d
MD5 c29849ab57df0bafbabab6d7e2d9d1b2
SHA1 4c3820a627987b2f1924c59c88142be2c422787e
SHA512 0a5fcd352fd02bcf4d5f0662b4444f892971cd640c014cc0cba7d94f8853a3225f2007f0d72370e2f4fcfafea27f89efd0bb6d5dbb65fa2a52e8d9e5e6f1876c
SSDEEP 96:xna1zeXQdTf6GahK2AK2SGtSgzF8OsVIsOhK3uK3Xlnc:41vduGkA8oxaK
TLSH
T1A5E18DDA9E0288BF3BD29F2B335331966DAB140AC7D4647277DF9506B0CA974041F1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e39cea69a14ce8aadb434a28a874f600dc5d68de13daba7112db5a4118b9ffb
MD5 bfa9b6b375fdd93007d5c85cc66ab36e
SHA1 b30c9d36c6c2b693a6c97b79d4174403b9e78641
SHA512 48e9ab90f1b0b1d2c1c7be1370aad44bde86a07635c3c3737cf9f58362fbea55459958bcabe4ea0271934f2bc0c5bc2e343c508bb8fc4c1ca096a7eee5109325
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmSVg9N9JMlDlfjRiVuVsWt5MJMs:pTMwBtOm+gFIDRRAubt5M
TLSH
T13855AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5d7be4b68b5d52691f0cb7690d00df41b675415df27e5312326dddb5dd1b2158
MD5 c5107ffc2ba764a65da0ccb5b15675e2
SHA1 947359de3f98d53bfffeccf441a5a1961931f9d4
SHA512 98bcff65495a7a9e4a21e71bf5d1415ea60aa60c5a21944bfab2236825219181e50296d01f9e0b3c3ce3189508419d9579745513ac6403290599f3743cf8679b
SSDEEP 24576:UPUr+NQhVg9N9JMlDlfjRiVuVsWt5MJMs:UJQrgFIDRRAubt5M
TLSH
T1ED85F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 10519ff6d30fb983adbe1b13488be356b2b9e6302e74c495c87597becdfd37d6
MD5 fb666f383f40f2e0362b7cb400b3f9df
SHA1 bc5545cbec7bb08546531487901f5109c5e24f05
SHA512 044d1cc72552e7785b17ab75d29b7e69cc54c25d5341161bfa47a54261ec54262d9950e663fccba12833d261e9b99e89bd21f2c7410c80f2c8350755aa22a5e4
SSDEEP 24576:tD3FHshBIYQgAMVg9N9JMlDlfjRiVuVsWt5MJMs:tDVHeBIAAsgFIDRRAubt5M
TLSH
T15795E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd92aff2209659e8.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\fd92aff2209659e8.bin
Size 12KB
SHA256 7429b888c2ffa7089481f9af72e1001df10a67fddaf81ae164c4acea504f7c9b
MD5 c8fd23f6342ff0a422f9569e50a09580
SHA1 4f805e268c9df133c0b85879d9cba9b56fa0fca4
SHA512 916bed9550c1ba5f2a70c482e0834b5a2965faf077e7f3b16091473899e254f5af9b419b29e04a7daf8cdf23121e21dfbe3bdc477e45b00b5d98fc947f035215
SSDEEP 384:AmeRHwB3cRxVD0Ga8E2qhHiZNMiUNAxro:wVRx90ahq5cUNAxro
TLSH
T18842C0B52CA7CA7D024936AF67EE3A220EA758933810C5C1E4195592E9219CC7E3E4B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-101-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1148-96-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1148-95-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1148-341-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1240-58-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1240-57-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1240-68-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1240-70-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1240-64-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/1660-444-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/1660-1157-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1660-452-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1660-450-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/1852-24-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1852-0-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/1852-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1852-7-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1852-8-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/1852-29-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/1956-487-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1956-440-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1956-433-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2396-83-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2396-315-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2396-91-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2396-85-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2828-268-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2828-72-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2828-73-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2828-79-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3452-432-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-167-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3452-161-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4244-187-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4244-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4244-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4244-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-152-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4304-143-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4304-149-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4304-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4304-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4344-489-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4344-467-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4344-473-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4648-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4648-129-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4648-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4648-13-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4648-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4820-203-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4820-49-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4820-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-35-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4820-159-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-207-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4828-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-1177-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4828-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-1179-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-112-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4828-106-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4924-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4924-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4924-352-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4924-349-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4960-132-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4960-131-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4960-386-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4960-138-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5148-456-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5148-462-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5148-1166-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5148-488-0x0000000140000000-0x00000001406BA000-memory.dmp

Download