99dbb646badb4334020997104dce26b6ae51a2ce01a30dcfcac5c6faa353a20c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
Size 6.9MB
Sample260924-d3fjjsda96
SHA256 99dbb646badb4334020997104dce26b6ae51a2ce01a30dcfcac5c6faa353a20c
MD5 75361b9bae525a0275e03da2fa68086c
SHA1 c1a76563521c237dfc136bfab1e59e4474c5c5c3
SHA512 69ada9609157dd8c51a4a2c05b94a16a254b1d486d061d1c649deb6d3cc0d49388b4bb40dc0cd97bae2ade56c203bbcf6da2e63facca9b529a558d8e86ccf69f
SSDEEP 98304:T+Vg3V2TYOd/pgWOtJOTpslgJTIZ5Bgp:70cANNsT6p
TLSH
T14A767C43F3B501E8D05ED9B4CF3956225B357C4A8BB092EF269836E11A71ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4712	alg.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
1404	fxssvc.exe
1716	elevation_service.exe
3828	elevation_service.exe
4868	maintenanceservice.exe
2312	msdtc.exe
1136	OSE.EXE
4152	PerceptionSimulationService.exe
3512	perfhost.exe
4300	locator.exe
4328	SensorDataService.exe
2148	snmptrap.exe
2000	spectrum.exe
1652	ssh-agent.exe
3352	TieringEngineService.exe
4748	AgentService.exe
4888	vds.exe
728	vssvc.exe
112	wbengine.exe
4868	WmiApSrv.exe
5176	SearchIndexer.exe
4784	chrmstp.exe
1064	chrmstp.exe
5528	chrmstp.exe
5596	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ae669227862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf810f56d54bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000014b4656d54bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db1bd355d54bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000670bbc56d54bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346943320014172"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002163455d54bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e540f855d54bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e5cd855d54bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c25c2357d54bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
628	chrome.exe
628	chrome.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
2960	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
628	chrome.exe
628	chrome.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
3240	DiagnosticsHub.StandardCollector.Service.exe
5412	chrome.exe
5412	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
628	chrome.exe
628	chrome.exe
628	chrome.exe
628	chrome.exe
628	chrome.exe
628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3776	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	1404	fxssvc.exe
Token: SeRestorePrivilege	3352	TieringEngineService.exe
Token: SeManageVolumePrivilege	3352	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4748	AgentService.exe
Token: SeBackupPrivilege	728	vssvc.exe
Token: SeRestorePrivilege	728	vssvc.exe
Token: SeAuditPrivilege	728	vssvc.exe
Token: SeBackupPrivilege	112	wbengine.exe
Token: SeRestorePrivilege	112	wbengine.exe
Token: SeSecurityPrivilege	112	wbengine.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: 33	5176	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5176	SearchIndexer.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe
Token: SeCreatePagefilePrivilege	628	chrome.exe
Token: SeShutdownPrivilege	628	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
628	chrome.exe
628	chrome.exe
628	chrome.exe
5528	chrmstp.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2960	3776	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe	86
PID 3776 wrote to memory of 628	3776	2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe	88
PID 628 wrote to memory of 2892	628	chrome.exe	89
PID 628 wrote to memory of 3972	628	chrome.exe	95
PID 628 wrote to memory of 3972	628	chrome.exe	95
PID 628 wrote to memory of 1784	628	chrome.exe	96
PID 628 wrote to memory of 4908	628	chrome.exe	97
PID 628 wrote to memory of 4908	628	chrome.exe	97
PID 628 wrote to memory of 3964	628	chrome.exe	100
PID 628 wrote to memory of 3964	628	chrome.exe	100
PID 628 wrote to memory of 3984	628	chrome.exe	101
PID 628 wrote to memory of 3984	628	chrome.exe	101
PID 628 wrote to memory of 1588	628	chrome.exe	102
PID 628 wrote to memory of 1588	628	chrome.exe	102
PID 628 wrote to memory of 784	628	chrome.exe	111
PID 628 wrote to memory of 784	628	chrome.exe	111
PID 628 wrote to memory of 5412	628	chrome.exe	124
PID 628 wrote to memory of 5412	628	chrome.exe	124
PID 628 wrote to memory of 4920	628	chrome.exe	128
PID 628 wrote to memory of 5276	628	chrome.exe	130
PID 628 wrote to memory of 5276	628	chrome.exe	130
PID 628 wrote to memory of 4784	628	chrome.exe	131
PID 4784 wrote to memory of 1064	4784	chrmstp.exe	132
PID 4784 wrote to memory of 5528	4784	chrmstp.exe	133
PID 5528 wrote to memory of 5596	5528	chrmstp.exe	134
PID 628 wrote to memory of 5376	628	chrome.exe	139
PID 628 wrote to memory of 5376	628	chrome.exe	139
PID 628 wrote to memory of 5352	628	chrome.exe	140
PID 628 wrote to memory of 5352	628	chrome.exe	140
PID 628 wrote to memory of 4376	628	chrome.exe	141
PID 628 wrote to memory of 4376	628	chrome.exe	141
PID 628 wrote to memory of 5928	628	chrome.exe	142
PID 628 wrote to memory of 5928	628	chrome.exe	142
PID 628 wrote to memory of 6416	628	chrome.exe	152
PID 628 wrote to memory of 6424	628	chrome.exe	153
PID 628 wrote to memory of 6432	628	chrome.exe	154
PID 5176 wrote to memory of 6792	5176	SearchIndexer.exe	157
PID 5176 wrote to memory of 6816	5176	SearchIndexer.exe	158
PID 628 wrote to memory of 5412	628	chrome.exe	162

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-24_75361b9bae525a0275e03da2fa68086c_glassworm_icedid_njrat_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=145.0.7632.159 "--attachment=C:\Program Files\chrome_installer.log" --initial-client-data=0x2d4,0x28c,0x2d8,0x288,0x2dc,0x1405e8f00,0x1405e8f0c,0x1405e8f18
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff06d4c728,0x7fff06d4c734,0x7fff06d4c740
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,4421914793380026119,9969749390077028395,262144 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,18436374332422973935,15546472851068197059,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16000371105198602293,1686311695136420156,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,6253065539410652180,16283104564950754977,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,15010587812269488098,14784875742139652681,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,4044688166352066032,15949658259630795646,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:2
    3⤵
    PID:1588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,13637067081534058225,6982142549666690245,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4664 /prefetch:8
    3⤵
    PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4836,i,7093975675750846386,8172402739312313487,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,2402154168583517754,2624260018008685449,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,17199423612875845299,13819057245796495076,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:1064
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5528
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,3682047031100424298,17560442771879269553,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,4507610935140471861,10575671216307377493,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:8
    3⤵
    PID:5352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5076,i,6227255092909827211,13942523782903490710,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4688,i,13327615565968911261,728535131983754615,2097152 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4780 /prefetch:2
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,2659269259191177179,3378759749396502102,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:6416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,7509675369013606204,13316258198873976800,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:6424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,11982145697272965094,10985376823152289713,524288 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:6432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5176,i,17477664260745403033,1602224181200874722,262144 --field-trial-handle=1996,i,4013199010279803336,10867475951260012817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5412

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4500

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4868

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 43f70396632774c5d2f48664757148af9b6ba898de2086372d0667a4f2f2ed61
MD5 3b52315e8bd18e287c3aa885579716c7
SHA1 4951cfd5e84c32431d49d5bddcb5d5a9226229e5
SHA512 da5fff1118750f67eebfd2921b1ce24c28a028dc3d01f29600605a207f9b0102b9db4f5e45ac926dc57edb1a33d92c38fd058ea0df96370d8ece0330febf8b00
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEb5+Pl6bJTIZ5jdgp1:73q6mjBHslgJTIZ5Bgp
TLSH
T1D9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 47dbb60919989bfeaed8331ffd89e06c74c58c8159ff920d00b392451fc6b7e1
MD5 c858b5304fc773131309b2d0f6a89794
SHA1 7bc9df035a8ed1772fcce81adfa69d22a06d58a6
SHA512 5fb7b087f2575fe9364cef182ca6889023f9622f935289c03d30e83b9b52c5eec999aba43e6de5e22783ba2fd3de7e755cb9cec4aa5a364d42231de68f6d3de5
SSDEEP 24576:MXYfDtczAQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:rtcOb5+Pl6bJTIZ5jdgp1
TLSH
T14085F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1ae49da975256de22055c7ea2bb8e8b1e24bd6c49bb4dc90639d06c390ffb8dd
MD5 98076113b55f0b99a743c278618c701e
SHA1 31d3702dcf5e10be9e7bd9b90eae020a91df7291
SHA512 06ac0edf2007eef621193a6f580997c751cb74d765f7bd1f6ee6687fcd59482c5d1eb87795e4fea14182696be08e32cca3cf81e3214c7402d4c1b3836034c1c3
SSDEEP 24576:B0Le5ji0hmxyrMhmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:BPji0AIlb5+Pl6bJTIZ5jdgpi
TLSH
T1AB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cab94ee151fa3eccc12ca35198eb0e31b58c4dd9e8c251961f83f7b2c9661539
MD5 bf4f603c88269ca07c929feb912c9db1
SHA1 4cac63e4b3abb194531f7481b9516abbac517123
SHA512 78d91815976cd488f0643c7fde924aebb5b03b91a5bc9ad9d9a7b2d4fe97fc999db2263c83c06d773ca062d080261fcc5ee44e051b88d6d806d2c7166d3093d1
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyu/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:b/ezSC6vUzPv+HjyZb5+Pl6bJTIZ5jdC
TLSH
T1E5756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dda10f1a81930be2b07ae581133cd5c71fdd746edf4674602cbdb35bbbc54cbf
MD5 3b71b549e0e79893324b357e69f432fc
SHA1 f127765e2f8c897fdcfb3f3efed3b361bbfb3c58
SHA512 f6b3c7b8a1536e053bf6a01f57c5409a5851e694ad71661ef39f25282d7aa22623412f8e578ed4f3f3dde21de0259acd1d4c5387fb7d86f40582a83036815b22
SSDEEP 24576:RVbqPb88hv/l+BEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:RVO88hXl+Fb5+Pl6bJTIZ5jdgpS
TLSH
T1F4559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7245a3422b66e77ec9f117cb89ed147eaf0ed900c154c518dc611a581b35d767
MD5 4e76d83316280c503b1ee5df08ce241e
SHA1 91406c389400799afabdd53e6e9dfb387314d815
SHA512 e345e296a427902ffd8128b78c2ff736ddd0e1a65f881155381989df5bdd212d6c36dc95fffa13253b98ab2f42203a1cb57434e3db92ee2cf060fabc226d7809
SSDEEP 24576:5Flmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:0b5+Pl6bJTIZ5jdgp8
TLSH
T1736523838B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 bb49627e6ad24a9267372ff9b28e5fe4cc18a74ef91068ec3ed6813accaab698
MD5 84632da533df9d18582f37734c707056
SHA1 ba3216d288d059f55403f2b20f12a651751bbe82
SHA512 b88fddcb0678b430d7c8c8604123f0df67e7a1cfdcc9a71510842d13e94cc111daf30e20a1f9ee0a96c959fa5ca9ffcb09fc46710216f11aefe39a6b579b2ffd
SSDEEP 24576:OwuGOW2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:OwNOWb5+Pl6bJTIZ5jdgp/
TLSH
T14175F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 ae6b202963c4117bd3c82da412fec0362f7a95d0e11283dacc2eab33f6a21be8
MD5 2759ae3fd5d2a16c20eedb21a8c501dd
SHA1 007fae00810a97588ef5d679e0c931d7f88f1781
SHA512 06c7ac063414c95b3852ccf55aca8334bd2e375ff43930e2ae363968e2f34d31d1f9a6b33329ebe69da66f6a8f94393621aea1cc964a76fba5ba990ee014d746
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 25d907e6230eb4a2c05d4e2b394e4ac7868e853979cb25c00e357608da4d2bf4
MD5 c6001923fad3b5cfdd99d84c8d2ea98f
SHA1 5ca9d2ae314f592856de006e2b211053d542b80b
SHA512 be28efefaf04215aa009ac696a81a0e891bb38075bd894141b35118e4fad221e5369195326e821494cb9f7df93562c8476dfb0410e309ccb736b55ad601013ae
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3jslgJTIZ5Bgp:2QyiKanX+PNTsT6p
TLSH
T109666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f42090d7416f1ba59f45b7853a3241df4eafd8412b5f72e45ea72a56776da47a
MD5 9d6d4c284a2487b721f02371fbacf540
SHA1 02d0368b10a4d4db24108cfb1bf9b8e6bdf50f41
SHA512 b04fb9177ce0140d144278f0af28e2b74ab8bcaf2c7d5251764437bcf1b56e8770db55df6881019b77db65bed8849550f33d58ac2c1f85cc830e9299f7b8513a
SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXb5+Pl6bJTIZ5jdgpr:Tu6JmIxd2drslgJTIZ5Bgp
TLSH
T138D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4784_13434694333816809.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4784_13434694333816809.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5528_13434694333655833.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5528_13434694333655833.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2e332d30403b6b0921c91b88b11372f4357d8883dd378e22e14d812d4f01011b
MD5 f554eafa6481f96971161acd094900e6
SHA1 14f6b38f7baa14b9ff3c5c921a64b503c54cf137
SHA512 a5a76871767722be8add1c0fa0a003f7cb0f0b69095dc8b47cde906c5682447fbc3c922e7524116278348464893e5b8b42bbfc176d8d0ba0d48f8996a4836c7b
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3U:AP4m4IpOO67W8Kub5+Pl6bJTIZ5jdgpK
TLSH
T14265AE2DABDC0096D0BB913885A58A49FAB1742A1F3286CB1170933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 b0c5228eddea9ed863ced09ec93f0661b8cadbb0eee1e829c826d2d6faf98c23
MD5 871553845444c79389fafce00e29b762
SHA1 cac68b14d10db92f3b2992b55f41c4132bc6ebe9
SHA512 2b92d61c6c7e2905f6e7ca9b4f898d146fe8f537448962456b1052860b6c2b7453db58ddee628b16e52b0b1dcf43870e1f09ee477569d90effb426e701ee7239
SSDEEP 96:9jaUlpXte9aYakhK3VK30279ABNEuchK2vK2ewrwZHtz/MB0:sqve5CJ4A65MZN0C
TLSH
T15CF1DD9A9E02447F3B868B3B338325A06E6F1419D7E8D57237EB6106F0CE964112F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 8d820aaf9c591d6af894af72315f4a33707607569afd4123bcd9f2fbe042a678
MD5 391b545326799e714f8758b964fde82f
SHA1 a4bf0a00086ab723a2ee911bd7e714dd8a1eec8a
SHA512 03a61f9dad6219ebace7e69e4c90a477780d24d5bad795da1b5af0c05f52c4a8255e0466d1f0d86b06a15af263cbbb1d3f6a9c1897fb0ee0d3e62a9cbde3ad42
SSDEEP 96:9jaUlpXte9aYakhK3VK30279ABNEuchK2vK2ewrwZHtz/MBOMkWhK3JK3UW0:sqve5CJ4A65MZN0haBv
TLSH
T15D12DF9A5E02487F3B868F2B33832551AE6F1419D7E4A57237EF6206F0CE964102F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8256c1e7622729c8ed5e3789587c3ee8d4f8f07403fa02195eb6fba9ec13911f
MD5 dfa4630601879ef786557c05c9d5aed3
SHA1 382d14423cbbb0e30a4d37eb87354c5ce473accc
SHA512 ba04920f41d72c2b3df7980dc5f18022ec63082e0efb2a715c828b7d8562263f888712a38dbdf71fe8975006b0dd2dda662ab387727ffba0ec6b21a77d3d811f
MD5 SHA1 SHA512

Submit Download

7d734eae-a06d-426a-b21f-3a44810cf3f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7d734eae-a06d-426a-b21f-3a44810cf3f1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3155e90a2019f56962f86f7b2e059eb5c73edea0303fcc15aca8fa10766185a1
MD5 9b41719ad3a0bc95479f2c711f36f4a9
SHA1 2bf5b34a94d83c71c326aa280e2c4f7a16735e51
SHA512 1ea9486397ecc7264e3b9855d52b2109353c6d030be8460bf169fdd334a21585356632710f5a5304dff4a1502177fa133731a76a67231b9b5cad7aac279803e1
TLSH
T105F028A9D822EC7B18FD0B5D60664B46F750136B3B81485F3B3D820D4FB063B468695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 38KB
SHA256 6f7dfed0702046b83036659bc57d9bbfb4e571980cf6200985b0fd60f2bd14a3
MD5 a2d5d02020379d56f67825564aa1bfb3
SHA1 eac78a10d0f5b9863e39348f5a97def5922e188f
SHA512 4409a2e384c33d6ba0f2002e31af39c9aa650fbb9059c67c0219a53614e8f90aac5abfaae39dfab1ae7375ae3b5c8e63da9a19da8a154b3bb0ad437f167e3ddd
SSDEEP 768:ZpWdv6FsdoHhHarG4uLnj/PaZ7j+vDK4R9fBQzYhQV0zpgBh:ZplFsdBrG4uLnLa1j+vDK4Cd0VgD
TLSH
T16F03020687F7BBA66F7B76FAE3B6B1066B3228803D685773D0406890285B15711BF724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9a2f5502b3ae67380e7a21cef206add06816877ad3650b1daf01ad520051b2bb
MD5 92eb869f5d2e663e1d913942f97c7fe1
SHA1 16d811228ab53a6abcbe56e2eb93024b2487fca7
SHA512 e61cce9ce9bc0a8e5abd39acfa22d9f321bacbfa6ec8f88ee86191d331d48bf7688a24c7565c0234f04d48052ad307fea22c7ef30e48a22a4fc6e5a98e975584
TLSH
T1FF618BF7C3D88A6DC85156F4DB21BE1FDE6D0A18122C3C56C8D8AE4B53E29B2D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 370994157ad9f8045bf07481264baf064a412d5b6538f02dbfaa68c24416f104
MD5 423c5111df5ee4b80835412f707d845e
SHA1 3ac88e879bb26a50259757ca3050c5c516429dc5
SHA512 5c9729c0929ccfd0088af805659e3f0cb173e823e71380a0bdfad9f9221102a4ecc04cd8710c63845f8266c2099a069de2d33101d9e47a4f2cf1e7601705616f
SSDEEP 192:ORXxuX+4RGv7EJ/9PRp28NXsb+WNndK2OL2rexciyIsnAUgtai:ORXxKyQTXVXw02k2Oz
TLSH
T1DD32933DAD90753B5DCBC66AE9263E53E3F5206220902E84DAF88A2D25D79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8754a48c74373793f1aa068ce51842d55d33e5274a8ae235d12ad9c785f5eefe
MD5 d32a9859bc81d1d714a3f60e2101d8b0
SHA1 635f37f3ebe5b0092d2288dd08c2854b1e87520e
SHA512 618db26099a93b75ee8d03d8474981119a94c3225df2fb44970bc03b24580230acfd8deac5e71bb12f4c776b73a373427718bff922f914dad5aad272170c4232
SSDEEP 192:ORXxuX+4RGv7EJZJPRp+8NXsb+WNndK2YL2rexWiyIsnAUgraJ:ORXxKyQFXNXw02y2qe
TLSH
T10742B73DAD90753B5CCBD6AAF9657F53E3F5206220901E84DAFC8A2D25D79CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 82dd2bfd11cd4e2087175d972b3e0cd5d4d899160d32ff8faf15a91e6c718111
MD5 41cd0255546724e3c751d102d5887952
SHA1 6fd4e2db9abf9193953a2892b56d4f25c9247660
SHA512 a7da5f019e2d0c0b4a4d52809f4d26c780d3f558df70da2bd39b1f32b69fffc998c842101eadc242b7f73c4806fdb9091d1b2d7b8ddd3991f3d7478498f3de53
SSDEEP 192:ORXxuX+4RGv7EJZ9PRp28NXsb+WNndK2OL2rexciyIsnAUgtaJ:ORXxKyQZXVXw02k2O8
TLSH
T1FE32B63DAD90753B5CCBC66BF9657E53E7F5206220902D80DAFC8A2D25DB9CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58c723.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58c723.TMP
Size 3KB
SHA256 f0f0b10fbad8108718ae7da6eb4f31f88c52abdf59e0445cefe5699c4c09d5c1
MD5 cefd30db204a60daf63de6723c2cdef1
SHA1 1f94a563d7184df4b4cbfcb6a40dc581550629c8
SHA512 718c36067cb7684616f3c5495b4c52d8209f8b4bad741640b7988fea9f4b418a32b3b761fd4f6a946fd0093d6194442a9be8e697094dd44d572ce4d5733369e2
TLSH
T1D961632AD0644CA30DF2BB297C690742F975437B11410806397E468C4FB3CBB8141FBD
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 598c746617f00a65d4ec8dbad2d6c80250ef93de8bfcbb6fb55484c095a558e7
MD5 e5d56566b81fd8e73526d1be91523fe9
SHA1 a49f632848db00de3cb2b41a2376ee883be3f72b
SHA512 8c280272f569c5d1f320f24b7f513a137efd3fb90f05da0e55c96c520befd57f835eda5a1a9439367a980c71d2a24ca74d11a5fd725bf59e83d05f8ac90e6681
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3atbrwa:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pK
TLSH
T1F862E867AC4C9E3B0FD4D649CC177B4FEDB8025661AE886482FB982503D4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6e7176b81aa31a4bb011363c3bc2186db68f7767bc1764b54aa99403287d9dd1
MD5 ea323280f48fffb650d19a8a5c6bdd05
SHA1 8f2d74ed5bceaecc06f6dc237e5d665ff02c345d
SHA512 e14cf6b80039ad2cc04ff3f726c3bb4424722eb5df8ddb4eaf7b6c260b5bb142e7b94525dd61fcebf886feff177c87cc65e7e536a859fd360194f0af0dd40d14
TLSH
T12EB01215C0819341C44203F01192689C31649F14F605134141F00E41D835165C02B565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902c5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5902c5.TMP
Size 96B
SHA256 7235aa6e4fa43188e62416fffcee4a70bfaa5223eeab4f74738d4213d4912c65
MD5 1a7bb7dc75af5b33103e72ed7b931e7f
SHA1 b67fd45ba7b2081dad2cbc7c55a0389c7f9d3719
SHA512 eb1570f65d61125ac68a83b65c8839a31a113f5ef054d52d4f2c163d61eaa021b9720ae1d40bf93bbcc20b5be7936acb35489f32257df1fcb1a02bd851c83e2a
TLSH
T164B02200C002B202C00A03B020A088C830E0FF28C203822382F02A22CC202B08030028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0d0cc8cfb0f69ea703792c43bd893dfe43205b10575c380228fcad3829b13924
MD5 fe24534a315f6472632a42bbdc2a21a3
SHA1 872ea53980956fc8c33ecdb567af0adbbbf552a0
SHA512 8cda72662a43b304a7dc003962d4f0bec0c1821c335c92dbf3d2d63fbfbc4766d75ade236cc031c3c5baab818bf1ad0142548ca5a4e5d2bd871b5212e2276d6d
TLSH
T11AA0021057C08C79DD0053B0E0B2869176B78E1F3E625747A4A1188499EB7C58101900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2d9111836b33a354a1dc108708a5090f0fde633c295fcb6ad314d4313e03493a
MD5 3439d41a8ad03300f7249d65fe08755e
SHA1 cdd06eaa422fa065761aa3f214303b78d0ce7a76
SHA512 145160cf67ad5ad9907adeba8816e951ab53e71e9a97a68237c15d852ab6a52ca50075fb7dfb6ea4d92da2fe49634ebe7c082cf5a7b868a5d0a618c84f544f06
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\index
Size 256KB
SHA256 932bc76ad39754148845c003275951a047e68b07f36fa610865456b795370135
MD5 a7c37895a09287123f5716e50e11a6a8
SHA1 c490e1bafb57d90685bb58e1ae283ba6db56ae8a
SHA512 50ec0e9613d0acfbec704f28eb4a3923a9754537ae446c21591e61b8abc7ca948b059ecac1db6ee76b074a97b5572b1a5d0033858fb25493a88ee58d7b93ccd7
SSDEEP 3:LstlNllkll/lSill:LsX3lEtSGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 4a59df682452b47dd4b3dccda897586cf062a0c528c9fff9d8f5c34b1d15c738
MD5 9579724ed434005dadd6cd6ad9c0c67b
SHA1 7b286c9e3a13d4b6feebd462762aae2c1beb2f88
SHA512 a671f5be79eb1f49f578e12e28ce2dab0c757805c49167652f7d2341cd2bab6bcb8d532e8626f93bf6995bba5a4415aa6c9d88cb7ba20818d1d46c4c762b58de
SSDEEP 6144:3rjeoHzTsc8pfDh5V6aI9vhy2+hFD+7t56OD9ZfSAppr8:bCMTs/pB6x02yFSXD9ZfS4e
TLSH
T13D4412376D99FC37DABC1882A04B6319CDE176DEC0DA669984925FC9F06F44C0633A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1409daaf1434f6501b6dc5613a00e594b6cf9fc529924bf06e5f2bcd66e6c248
MD5 9987c9ff379a082e9fca50b615799df2
SHA1 0b9bb5144b5022b0537f1a914e16d35e33351c8a
SHA512 6feeb22a721ce4ad253433735d4e3df3758db547e8d076f0f2101e8e36940a496b4975ad2cb88eeb493c081b6d5da927495bea98ef583970a56b452a0fb39ba5
SSDEEP 3072:P+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:P+hFD+7t56OD9ZfSApprr
TLSH
T173D31232AA95D9BBC9BC6541B157A300DD76A8ED41DE3A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 5a86c5125ef78a740c5309e9dbafc4d9cbf4a04a2ad7d269bc1c234a1fa95a95
MD5 2974fc73431f8db90c3ac6d84bc4535a
SHA1 f2621219147900e18b34b43e1ffb9e9d09ea8961
SHA512 50c2f14c5c49663f0f3855c53401381c27762aa84a24731db3c2175269b7c26a6fc42f7c60317ccde47caa145c68b941e08f2fea8dce2cd514ce46400c33d7a5
SSDEEP 6144:4jeoHzTsc8pfDh5V6aI9vhy2+hFD+7t56OD9ZfSAppr8:4CMTs/pB6x02yFSXD9ZfS4e
TLSH
T1E84422266E9DFC37D9BC1842B04B6219CDF176D980DAA2D584A25FC9F16F48C0333A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 887b23333b288eff1158ed5079848374306d976bfe391a95512b50a2c6f41801
MD5 b0db8f4910934d9b3bb11ad32612df20
SHA1 a7caec14832354161eb065b1a9dae7e672bb6f85
SHA512 7c6f9a5593b7697565fc53f6d0ae7793fddd7919e4c496bfe899026221785f0909c2612933cdcbaebe62cb1bedc11a241342f77b237d5007f5090a00f456a619
SSDEEP 3072:j+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gq:j+hFD+7t56OD9ZfSApprq
TLSH
T10AD31232AA95D87B89FD6581F157A300DD7268EE41DE7A0984465F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09c53635-0fc0-4313-878d-ca9e269bcda7.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir628_85088085\09c53635-0fc0-4313-878d-ca9e269bcda7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir628_85088085\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ae669227862f6ed0.bin

Path C:\Users\Admin\AppData\Roaming\ae669227862f6ed0.bin
Size 12KB
SHA256 9252d5b6d4e44229ec06eb1573788dbed63c8ca454b92c6496639cef280ae0e8
MD5 7038e5d6bc1f45dac5576057fa1d28dd
SHA1 44f97653fa4930965a7fa05390f5df5576ce44a5
SHA512 77c64d54e6e73bf37b2ff18c4e86fe0901ef623f92ccce89e4d1552d2de6f2f59159101a2d1d5fde50a24248b0a06364e900743a33ccde6363474f718559d2b3
SSDEEP 192:VQniXZI8oX85zvsryG8TEncaN+wGExtwORVa5AqxJxvYkMgD/eUwp3DDCW4a8378:VQnpOG6Yfbxt5gJxw35UU33Z8HI
TLSH
T17D42C01DC8886F23E727428237E326098DEEA4F784B7488961DC115E931EB0E15A97E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4b846fe40ea3a444c46f28e1b838ac59ce22f20553e17ef2811dbf269c2b7d0a
MD5 e215cf3b354fbf73214785d37194b984
SHA1 625244f33bfb4bab4889a588d89a18a2e06b8a81
SHA512 2e8a283dcefaa540220dfb71a188ddd11dc6cc20ee5654835ba79096aa6fec21bc6ba7f200d87c739389ae7f8c4e227e4ea1be8607f2664db639b9ecb57e7df7
SSDEEP 24576:jZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:jUb5+Pl6bJTIZ5jdgpI
TLSH
T16E6523438B6E6086E0BB5735D9C9C710B83EBF65CE8666A7C579142BF1307897C2230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 273b9d66cd8cdf7d56f831db30e22990fc4dd2f1945d4092a50c390399a26931
MD5 ad7374429ea701f15610f2200f0cda02
SHA1 9068c2a01f7c414e36c2dcbaf12d0a8afa280d72
SHA512 a775411b5b30ee3b3b2113f8dc792a7f5388fae90885b1a68e51b249c67c9af2125a28e869fa01178900a9aced6daf56582eb5438466ca88666aa450e77867d0
SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQqb5+Pl6bJTIZ5jdgp+:ya0hNYG4JwJslgJTIZ5Bgp
TLSH
T15A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 f92a8e107562e79dcb3c6517305482b68d4865d203dfda63299afe6c64e66e8a
MD5 aa8ec91617260df1d206061ed5496117
SHA1 b2231f64169bde16ae499ecae7a6ec3cfd69d139
SHA512 baca643cbac5acb08cded90f1be2b43478d33bd42acbceab5c4b591857c5fc8d2c3eba32d27bc37e38f3c579dac1d5630679f8ce9d7aebffd90c8627adebe1f6
SSDEEP 24576:jhbHjPumb57GBiOl6a8JTth/RWZvR6wQQ92pN33:jhbHjJb5+Pl6bJTIZ5jdgpd
TLSH
T16465126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5eef7a9a60cb0ad2880cf504e1fcc86cc39e33a0a27dcdd328d77e42e27c8397
MD5 327e83779bbcf83ad8fc026221f6467d
SHA1 749678f06dedac0a2534aeb0ddb1385801699c67
SHA512 b342196ab6a12722235040228df67d79c5231b01f0f6575e89524b03f6fc36ee051e4e3a903463dd5acdf020860fbc26217ec71ff4fa26a06ddb133ae7dc0675
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:CIgnaTk46pBR/5b5+Pl6bJTIZ5jdgp2
TLSH
T14F45C02EF2B910B9C4AAD236854147B5FB71782D1F209ACB0170C538AF1AED85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 96776f44be56c632e4415f96dba6156350cb13d7dfa166ad765273dae10199b9
MD5 04835ab60303d0455fd4141cd05dff20
SHA1 b8c1b1712af7ae75c974ac24d1b59a23ad98e792
SHA512 bcf5d7795c3e629a61928918f1f4387fa9a6aa85c61e59a1f4c45d4170cfdb9c460ea026168b15f329ca610314cd7d3e914cce94d882732aaa7acb90b4d2a21e
SSDEEP 24576:dFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:dIb5+Pl6bJTIZ5jdgp6
TLSH
T1826523864A6A20CAD0AB5779D9C9DB00B879BF55CF8727F7C479142BF1347C9383220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 596a6348aed6dc8f305d62528fdaa212a6f013e1b0b6b81ebb6c78eb80ba7ecc
MD5 ea2f52759a6e3d93387f058bf3ea6639
SHA1 6a2cf8e704a7e3b3051a8e979dc6b8a0e18111da
SHA512 3ab9b541d3a84c4d18802acb9c0f381b3fe9573a8c4353b5c64453ba273fdd9bc2218f1f2352ce0692f466f51c0ff2b3fb457b4fb4f7b6c7a4103f91aaaf8869
SSDEEP 24576:vBL3UTQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:vBL3Urb5+Pl6bJTIZ5jdgpP
TLSH
T1B5850245E7A500F9E87B823CC9A6CA12E272B85D0754E7DF03B84A661F233E55E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d54025b04e45b0ea598f486db5ea704a8bfc3f8e5fcad780a8c64a3de7a7239f
MD5 2af993267ee4c73de2357f3ed6f533be
SHA1 5f88c6bb0fe6c88c2f5fc03e115120092e99c30b
SHA512 27a7064b72fc419f1623afc42ece15e6eb37f8477217c88542f062f1069af53cbd7b53522e5d0e5ab2b0cd7df354a132e8f2e76f8634a88086de3827e58208b1
SSDEEP 24576:pO8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:pOLb5+Pl6bJTIZ5jdgp0
TLSH
T11D75020A27ED20D5E07AA23DC9C68709E771B8664B1257EF46E0407E5F63BE87C36742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 18344984fafe98c11896bb53917c5041920ac07181d68681549dc9fca86cdcb8
MD5 e419a0448b3d4971f5416d1bf46c6cdb
SHA1 75c8c01f6b3f0568be347a9a87e4129b3185edd9
SHA512 af9fcc5dc544490d7cbbd5880c7419fa1c716e8aa9c41b380ffc8c411b592f2a7b2cddba9a3a469e0b4adec80ee2dbc96cae49ee161ced82551d8d7a12a75d8f
SSDEEP 24576:w7NM9YqZqmWMUkPjZM48Mv6bEhspmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:w7cBWMpPjN8DbEhxb5+Pl6bJTIZ5jdgU
TLSH
T1A265AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 447f0a9debd13059cc29d5334107d41635a279553221f9c25b5c301eebb73895
MD5 3715d1cd5721658cb204ffa4a3b7dc8f
SHA1 f205981954d4b36088860c3a68b6f1a5146bf22b
SHA512 720ad72d35c072c68920fad2899bf7cd090567d09c1d739b02155c6e5eea10ed686d84a7a7de61afa32e0569749c61ed54864c8a6c7b34c9b1b90708ebcb50f1
SSDEEP 49152:7F2YuHNETovAvNYf8kmEb5+Pl6bJTIZ5jdgpi:a6BCf8k/slgJTIZ5Bgp
TLSH
T106858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9d00af22e5161106c81eab6b41ebf9316ab8407f93f776d8223a2c914750d5de
MD5 3673bf3ff1cbcf64294ed71feec3a251
SHA1 03c342ee1538133aefbc23669eb814a95e1e0561
SHA512 d82c88f4fa5ef3422bbfcc72122d8e45752799b5ff519e33610717ce8baee447cb0a9409670a78af8437c221171096ef5e32b4b03f42c26366ef02b0dd1a464a
SSDEEP 24576:nAFs06+Omlf8NXEbToImb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:AFs060loXuKb5+Pl6bJTIZ5jdgpX
TLSH
T1C965BF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4cefd08f9518eb3a42ed98524c77f977ad91d87572ef498d5b4190efee7f5420
MD5 0b2f2f50cf8770cdcc63378e51569edb
SHA1 b9f6c340fbcdeca0455f5cb2e9f05ba59c7b5524
SHA512 185e75fba45ad6d126d61fbf3f93446cc23f8741649842b7c7db4b6c9d90d5513ed9e1eda562ecb3e4e66f2dc06a47485b82aa7ec6ec21d146bc6fc7e1879a8c
SSDEEP 24576:2JnJ5D3Wxzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:2JnJ5DGxKb5+Pl6bJTIZ5jdgpE
TLSH
T10B85DF2DD2A810E8D4B7C374819A5B45FE72386D2F226AC758B4D4357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 65f189c169a7f8c35317ff3c53a1cfc38e6f47dbca31d4585e43caf5b49e8aea
MD5 e599d4504e3e8a5c465d0a0890061227
SHA1 f5e20574ed27855feb6a6ad9f29c1fba8f367000
SHA512 5b289b80344b915a2fb6dad173830a87ed3237a48c4c306a59be1f9695e73dfcfa010da12be570076874b6083ea07c7c004ce22cfb77fca3863b634ac34817d6
SSDEEP 49152:Cg06DIKdwc+eQnSt65aVAb5+Pl6bJTIZ5jdgpk:7cslgJTIZ5Bgp
TLSH
T15B956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 a3554f1ad27f75cce90f25f67496f72a37c0f5513fad184fca30404557237d73
MD5 d6151c6659004d094d7fd4ab84be930d
SHA1 fec9f327d89097cb8bd1649553943006e8b5c507
SHA512 9dbbf7428d903d97cd956607aac23ba2a17293b5fdb2883b8bb80938d5ed30726a41b085548bf35144a1a2b77930e90a180eb02521525d2d1276e53e40b8e5fd
SSDEEP 24576:i8omb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:i8fb5+Pl6bJTIZ5jdgpF
TLSH
T1AB65015E1BAD70D9D06BA23DC5C1C604E3B2F4619B4227EF46A5813E9E33AD92D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 3e9c324a8abbad207d54d071e6b29bdd4ec7b918a877db89cddd8d9e1e6f3c8b
MD5 460f1798d95329de8cda82dca25e0779
SHA1 ba99080730a596986283007afc5135167e9d650b
SHA512 d34dba4a29a5f60c5e150ddf70368f6d6a4a6407d2526dd8754470610a1e7d87172fb6a0a273f72b1831ad1cb14e5ec20ecac68e4ff0797497e289b6e627c8e4
SSDEEP 24576:nIyemb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:nIab5+Pl6bJTIZ5jdgpl
TLSH
T1E575124553A860C5E5BB4738D9E6C350A979BD21DF1263EF80A0A63FAE36BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 6bc31ed8191bc189aeea103d9da97f4823feaf065fbaf52b6d765e841fd033ed
MD5 9d34268b5876dd2be41d261494063ece
SHA1 74bb8b6240e8d2924e50aa6d5038d5de508ae767
SHA512 06b4b4b5191f165846ff31c77135d6ef6442fa27fdfe732259e6ab1940cd69fb5ab40e8da68c2e301ac3bbc5e6df5ef9d676661851d4c6f7cc60eaca88cf52bd
SSDEEP 24576:zsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:z7b5+Pl6bJTIZ5jdgps
TLSH
T17E65234A4A6A30CAE46B5779C9C9DB00B479BF65DF4636FB84F85437E6313C9343220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c9410dbf6f4d6fa1ca81e5dfee62b978200071bf1ef3f84e9e9959f1c5e6df78
MD5 ea8f00454fd0a09d9b91ceb09293e9fa
SHA1 5e14372b8ab96e641f6d53f7f9876031dfc62908
SHA512 9c72915f909ffefe7a0cbef7cda30d1cb742103c6d7833c4cd7102a1e0e64d1c2bd4f7e0d2e82e74afd25166746cd39ff70d0309023acd046af4dfb1faf86724
SSDEEP 24576:RQ9MxZKdcz9dw3Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:RVKZcb5+Pl6bJTIZ5jdgpW
TLSH
T1B8558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 8e4a16209bb6a31ed9f69919963e9cdb61064d75713c2012deb081aa71495aef
MD5 64eea79fca0e4db325d19402f0a83b0b
SHA1 f80cb22f620bd064e3c9bd4845ad6ce52f093778
SHA512 cb35843010de0f5115926d1aa10ed8d0b6230e9d9a3ce711309d2a8a74e727db41b50504a54acb1f68e99e5102f4cbf34e1ad7cce3c550b18ade10040c120416
SSDEEP 24576:QyocwApqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:docwApVb5+Pl6bJTIZ5jdgpL
TLSH
T1C175E00FBB6A40D2E066823CC9858745F773B4309B5267DB55A1C33E8E27AE97D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0598b4131fb765874f912d2bb84daeaee3c248de8158b4b8e5816356a82af814
MD5 b0826b97ffc27eab646a96161d5f58ce
SHA1 c8d42ce9676e765b3c748a9b1fc0a05d626361c6
SHA512 f1c5a891313ae3dd2ccc3683a0d60b77da3f6a1e249c3ad3bab6b156c17fa610c82f0b7e8dd9859d9aa50defe2e77057549edc41fb2b5e8b851cfbb034e4e35d
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKVb5+Pl6bJTIZ5jdgpS:U0zuNI7slgJTIZ5Bgp
TLSH
T1E0A57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 22af4eaa0ed553dd89d5b5e56806bbe664b9437d56f1383345eefe91beb0b91a
MD5 c469d9382e92883b36f1a983b986353a
SHA1 72fda4d51f1847545dfe343d1db62b98c287bdaa
SHA512 4fa4e610c39de037017a727ee0808e5096ed7a6addc53b9df2d5877ec1f97fa7cf5d460f8b80f7f0a2e4091cf4e0c70f90490ba6b5a0801db11faa94f57cac0e
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYzjMqbfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:8TDxR+N5YzTBjMrb5+Pl6bJTIZ5jdgpu
TLSH
T12455B02EA7F915E9D1BEC6799A23C502FA727821073193CB42A0C17E1E375D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 66e222c125d883985dcb18762b15cc7eb07b5f8a6f49cb0def6b1a7296cdd394
MD5 dfdec86c6283ef8f8198f41e8d0e4ede
SHA1 a43e02ce3abb6d15d1669fe84c9bde6d06c0c390
SHA512 c74b24f55fa4efa537aa0670e09c409901cab0a975414e48b48308280858d75e04d5ef2f47c269889872d1229937514b4adb28eb782dd8dd6bc3edeaeaa34a02
SSDEEP 24576:HTMdOz0FFS+jmSLrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:10K+jmSLib5+Pl6bJTIZ5jdgpt
TLSH
T14A85E17EA36D14E5E47BC27DDA838A06F5727462032266DB06A0C07A7F57FD4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 ae3ecbd165e20bd5930d5278e1b0e5010766e64fb475bbe5d845d743ca689d6e
MD5 20f59bd66d6f8c8d3d0bc804cfe73d5c
SHA1 d5254ab2307133df1129b6a62c3f66336a427c12
SHA512 a146413e41a2a7faa071ab7fbe3a7412341910c8f2d7b2e57f251740f5061fb83c3945f924afa48b55999f3eacef953700f77981b45cf5a9172a5bd3ac387848
SSDEEP 24576:MQmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:MHb5+Pl6bJTIZ5jdgp3
TLSH
T17265120A17E930C5E0779339CAEA8700E570BD669B5627FF15F4C83B9B326C8A835702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-498-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/112-200-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/728-196-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/728-491-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1064-479-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1064-806-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1064-473-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1064-481-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1136-191-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1136-114-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1136-120-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1136-123-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1404-108-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1404-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1652-181-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1652-427-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1652-172-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1652-178-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1716-63-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1716-105-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1716-67-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1716-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2000-168-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2000-160-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2000-166-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2000-411-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2148-157-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2148-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2312-110-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2960-107-0x0000000140000000-0x0000000140729000-memory.dmp

Download

memory/2960-20-0x0000000140000000-0x0000000140729000-memory.dmp

Download

memory/2960-11-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2960-17-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3240-39-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3240-44-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3240-33-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3352-445-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3352-184-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3512-147-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3512-140-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3512-145-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3512-199-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3776-26-0x0000000140000000-0x0000000140729000-memory.dmp

Download

memory/3776-0-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3776-6-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3776-8-0x0000000140000000-0x0000000140729000-memory.dmp

Download

memory/3828-180-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3828-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3828-79-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3828-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4152-135-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4152-128-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4152-195-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4152-129-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4300-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4300-203-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4328-209-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4328-153-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4328-369-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4712-30-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4712-139-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4748-187-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4748-189-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4784-464-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4784-468-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4784-527-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4868-508-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4868-89-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4868-97-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4868-87-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4868-98-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4868-204-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4868-81-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4888-470-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4888-192-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5176-256-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5176-529-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5176-210-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5176-820-0x000000000CE90000-0x000000000CE98000-memory.dmp

Download

memory/5176-222-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5176-239-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5528-492-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5528-485-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5528-495-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5528-521-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5596-807-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5596-506-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/5596-511-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5596-500-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/6816-824-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-849-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-851-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-850-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-848-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-847-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-844-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-846-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-845-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-841-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-843-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-842-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-840-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-839-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-838-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-829-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-830-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-831-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-832-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-836-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-837-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-834-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-835-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-833-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-828-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-825-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-827-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-826-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-823-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download

memory/6816-822-0x000002798A2D0000-0x000002798A2E0000-memory.dmp

Download