7c94be5f8e81df2a28e3197081d6bc993383655386bf6091fcd1e3eef7120c09

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.2MB
Sample260930-rxtqwaaa32
SHA256 7c94be5f8e81df2a28e3197081d6bc993383655386bf6091fcd1e3eef7120c09
MD5 01509f9c3b959d2f85dda9299ee7d92b
SHA1 e3e5a3b2d9e0a4428ddb96a6fd6a03e4e40e3c54
SHA512 e7abfeb9752205840f1a7dec4797bb03ed26746ced7c56183ed215d44fae81140dabcb776dfb25c79a97208718eaf2e31fdf5e2b315de7e9c1c053b1bbf04185
SSDEEP 98304:lxY/1vFNfURgr1bpwvhGBs28l6CEof+EaCKDVn5p4NZ+u0GorgTFlF2:rsvY+5Bs28l6CEofsPR5pD/TsvF2
TLSH
T120968D13F2A501E8D05ED674CF3A56329A317C4A4BB0A2EF269436E11E75ED47B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
2492	alg.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
5020	fxssvc.exe
2360	elevation_service.exe
64	maintenanceservice.exe
1240	msdtc.exe
2428	OSE.EXE
3760	PerceptionSimulationService.exe
4196	perfhost.exe
2652	locator.exe
4080	SensorDataService.exe
696	snmptrap.exe
3520	spectrum.exe
640	ssh-agent.exe
404	TieringEngineService.exe
3364	AgentService.exe
1360	vds.exe
3788	vssvc.exe
4648	wbengine.exe
4056	WmiApSrv.exe
4108	SearchIndexer.exe
4808	chrmstp.exe
2016	chrmstp.exe
5848	chrmstp.exe
5936	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a401afcc665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f025200e950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a393a1ffe850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6a84bffe850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfe52d00e950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7e5ceffe850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018251e01e950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e81e61ffe850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025c9caffe850dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3676	chrome.exe
3676	chrome.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2408	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
3676	chrome.exe
3676	chrome.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
2024	DiagnosticsHub.StandardCollector.Service.exe
7112	chrome.exe
7112	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2612	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	5020	fxssvc.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeRestorePrivilege	404	TieringEngineService.exe
Token: SeManageVolumePrivilege	404	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3364	AgentService.exe
Token: SeBackupPrivilege	3788	vssvc.exe
Token: SeRestorePrivilege	3788	vssvc.exe
Token: SeAuditPrivilege	3788	vssvc.exe
Token: SeBackupPrivilege	4648	wbengine.exe
Token: SeRestorePrivilege	4648	wbengine.exe
Token: SeSecurityPrivilege	4648	wbengine.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: 33	4108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4108	SearchIndexer.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
5848	chrmstp.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2408	2612	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 2612 wrote to memory of 3676	2612	2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	88
PID 3676 wrote to memory of 5040	3676	chrome.exe	89
PID 3676 wrote to memory of 848	3676	chrome.exe	93
PID 3676 wrote to memory of 848	3676	chrome.exe	93
PID 3676 wrote to memory of 4876	3676	chrome.exe	94
PID 3676 wrote to memory of 3300	3676	chrome.exe	95
PID 3676 wrote to memory of 3300	3676	chrome.exe	95
PID 3676 wrote to memory of 4276	3676	chrome.exe	99
PID 3676 wrote to memory of 4276	3676	chrome.exe	99
PID 3676 wrote to memory of 936	3676	chrome.exe	100
PID 3676 wrote to memory of 936	3676	chrome.exe	100
PID 3676 wrote to memory of 1844	3676	chrome.exe	108
PID 3676 wrote to memory of 1844	3676	chrome.exe	108
PID 3676 wrote to memory of 5856	3676	chrome.exe	121
PID 3676 wrote to memory of 5856	3676	chrome.exe	121
PID 4108 wrote to memory of 5320	4108	SearchIndexer.exe	123
PID 4108 wrote to memory of 5656	4108	SearchIndexer.exe	125
PID 3676 wrote to memory of 468	3676	chrome.exe	150
PID 3676 wrote to memory of 4808	3676	chrome.exe	128
PID 4808 wrote to memory of 2016	4808	chrmstp.exe	129
PID 4808 wrote to memory of 5848	4808	chrmstp.exe	130
PID 5848 wrote to memory of 5936	5848	chrmstp.exe	131
PID 3676 wrote to memory of 5652	3676	chrome.exe	137
PID 3676 wrote to memory of 5652	3676	chrome.exe	137
PID 3676 wrote to memory of 3940	3676	chrome.exe	138
PID 3676 wrote to memory of 3940	3676	chrome.exe	138
PID 3676 wrote to memory of 5576	3676	chrome.exe	139
PID 3676 wrote to memory of 5576	3676	chrome.exe	139
PID 3676 wrote to memory of 2332	3676	chrome.exe	141
PID 3676 wrote to memory of 2332	3676	chrome.exe	141
PID 3676 wrote to memory of 468	3676	chrome.exe	150
PID 3676 wrote to memory of 6052	3676	chrome.exe	151
PID 3676 wrote to memory of 5932	3676	chrome.exe	152
PID 3676 wrote to memory of 7112	3676	chrome.exe	157

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-30_01509f9c3b959d2f85dda9299ee7d92b_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.59 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x288,0x2d4,0x2c0,0x2d0,0x2d8,0x140718568,0x140718578,0x140718588
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb5f6cc728,0x7ffb5f6cc734,0x7ffb5f6cc740
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,5325753309943034216,13185471961646635781,262144 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,15722349908071033876,7195462430154928035,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,16740402142082892447,3497802332849627986,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,7251530689788095286,497231690586144150,2097152 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,11646521058217703548,11324847207320090111,2097152 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,3310751206898078279,9200791073505374752,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,5645848347087417113,3226641167298091364,2097152 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:5856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,18010424260284161414,17255035343589688924,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:468
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2c4,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:2016
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5848
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2bc,0x2c0,0x2c4,0x298,0x2c8,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,16448588330525630962,6600915614944296668,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,1889667417322226496,5595902862019283472,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,6504966797992215768,17789315765947317695,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4680 /prefetch:8
    3⤵
    PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4536,i,8226420895516768172,833287736310829936,2097152 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:2
    3⤵
    PID:2332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,4061811510257725979,17300993643622439546,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,15685536775196285259,14667053433437997549,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,9587387221068754850,13354230421468201307,524288 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5748,i,16407896974493259491,15396569957685555810,262144 --field-trial-handle=2000,i,10899106355564560751,9254690739271897908,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1420

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:64

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2428

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4080

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:696

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:640

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0a878a6843a6d5acd10690333d9c1b3c2568be946c385fd9c6558097613e1294
MD5 8d849ecf35ccdeb959fe33f5ec54ce85
SHA1 4520a6d09711217a676e1c2374c8445a891344b5
SHA512 635fd521f7969f35091d920ec56df3a1bfec5d0e73aafb3002862418eed3ca5dc0211fe06149e50ea4937daadb6c0fa084c38665454afa5bc94f603ab443457f
SSDEEP 49152:tb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn3krgTFSAI22r:z3q60jBlrgTFlF2
TLSH
T1BED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 e872384f5e8eda5e243cb01b4c86cae1bf9444df0c6540562f9dd2169afb7092
MD5 3e5b19841469e801108f2f6fed4312ed
SHA1 4c72abf0fc0f758e13ea6f98a3292fb0ac2e3195
SHA512 528572c3db545165670aecabe9872884a8c5250fa2c5854aa039ae1d1e931f6cd0b5dded0b221f5d251de258028d3f564151859890464489867b56ef5313e2e7
SSDEEP 24576:RXYfDtczAWkzHSdTCQSMbnAqMtdcVrvOG:0tcNkrgTFSAI22G
TLSH
T175550124A3A548F9ED67813DCDA28502E6337C9187A0E79B03E4D9391F233D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 c624ed611b53c2c236cb29f75114bb2eb2d4099b8724e3d524489882f4bafd81
MD5 10333b0f821e17f153cf651c1cada65f
SHA1 6b5d630a27b05eaa498ff12773150b1f91a8a72a
SHA512 9ee226cdfe798a33e929c49baf0b65ab1fb7dc47bf18c1769f0adcc884643eb5d8f30695745f66f0eb6886c6ea088fc505937a6c0a5e690912f128ec11591033
SSDEEP 24576:K0Le5ji0hmxFrM/kzHSdTCQSMbnAqMtdcVrvOT:KPji0ATgkrgTFSAI22T
TLSH
T1CD759E26F6748771D073C0B9C5D2A68AE97130825B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea8f84f7fae74e4570ab7018e80090e3d5ce00167f81b1341636a5d1da35b997
MD5 f7ee406d461182ba6f615bcb91b373c3
SHA1 62b92409bfc5778786eaea16cb36781dc628bb92
SHA512 67dbce6cf3a176742390eb92cf8353dac12a27c69c4d14cbccdc800f399191b41aef9475948d15c06100cc62468adbfb512bc18a17cd4368f7edf357dac552c7
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWr6q8wyudkzHSdTCQSMbnAqMtdcVrvOh:m/ezSC6vUzPviHjyUkrgTFSAI22h
TLSH
T1E2755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cb39795e8b69adbd13b710afc44b5b3004de60d1de79cc97f18833c4ae67a5f2
MD5 8481c7341a3fceeaf02bc9de860809e2
SHA1 ee613106793de61b049e314f8eeb101f52015e98
SHA512 738426fa39e432bb0b6d2652bdcc831b6009fc7abcf112152aa6072639c6f35512b9aecfffdc5d901a96356d0dec01cb90ee879f79bc6cd7616e76cf05e7c6a9
SSDEEP 24576:4VbqPb88hv/l+bykzHSdTCQSMbnAqMtdcVrvOg:4VO88hXl+OkrgTFSAI22g
TLSH
T1BD559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 7d01e37f780975797e2437484fbee43164a38238974f1be3d983000392309901
MD5 1ea4a513d31b3412aeb1a7b0c97a6993
SHA1 03b2bf64685b9a498e683d3d12b66029929328bc
SHA512 16590ef18dbeb9896e4d22524b858603b83597e59c4cb267397f011a284094decf567464f6399ce6166b6a0fa984f4c77c336546df1918c57078a838b9895325
SSDEEP 12288:Jb2zDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HU:JbbkzHSdTCQSMbnAqMtdcVrvO
TLSH
T11C352311872AD8F2DF374535DAEEA9C344217EE1D890E3178A84F93D15B82A6E06335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 8ad03b730b7dbebbf66c213c86d6db023395d5c489654e505578914f5b8c11be
MD5 f466fbbb26b827c3d88214df16de9afe
SHA1 6961c68281996d10badfcaec92498c0fde4b00b5
SHA512 abd7225f1a777d775b8674197aa3d646e7ccaa8d9b98c6b844209d151d5d8834b78e6f23af93e0cb8dad7a9f082c1cdbefeb2cf886b6481b145600e08a5aaf03
SSDEEP 12288:XeBNUbTVO86UjzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUI:XJIU6kzHSdTCQSMbnAqMtdcVrvOr
TLSH
T1FA55CF3BEE28FCE2C67A8D785B918640D77278704B61A3CBD164C20EDE235E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 197af2dbe6b3897a66a8d1118e94d7ed6403656c339d679c47a1c495225f9e55
MD5 0a0d060c805ab76d0b1d54cb8d6fa8b7
SHA1 839534b613291bc45b11dccd36434b1249b7056a
SHA512 f032ac8aab2532e16a75325924b56e68ab0acc6dcb0ee9e0a69074b015b5305b85e03358df124882bd56720b8abc29b3b5602c8ebeb95e4641d0111f0605cc20
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH1:wQvGAdlCEL8c/RRNw5C6rgTFlF2
TLSH
T160266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4b84fd6698da32f5ba65037eb66c0796e0557de260c0f81133154cd555fc2dad
MD5 386170b03e8414437e1c090f180da34a
SHA1 300646dee14ce3a01a3959bdf215a072e6bfa36f
SHA512 2b002c462f87b1d69534d775de7bbf7259a410da8ed0e124239d81ba2ef1ac0eb3bf5e04cb6440fb2d5850340cccc90428fd6775e92612e3d99ebcd7fb984b60
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zQkrgTFSAI225:7oqtVjnmWrgTFlF2
TLSH
T12FD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 0b7c9cde371f24ff3edb3bb6a1ea85d3cd122279d81922ee0075a6030bd44338
MD5 ce25844fea704bb973d4588691c2b1a2
SHA1 d9bfea66015dd248537a22c2c1be7357ec808ff5
SHA512 2963ecf0c7079147b1823d9ef5e877fcf850bfa18fac4f3785f908042ed3e1abad69aa0065d6366bcffcfd71599b733a348ec2c1fcecb89f2a68e01d9896c842
SSDEEP 12288:Xmw5HEjsChNKBFgl0WDm+CczDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HH:2wuPOW0kzHSdTCQSMbnAqMtdcVrvONp
TLSH
T1AE55F14573A90CF9E9778138C697C136E7B2BC522A21D71F0760C62B5F37361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 0eb0d10dcae9158c1a333894b8f7e680471b319862f067a7f99f0dd3433f699f
MD5 db669b7558b0ec7af9cdbae2bcb38d08
SHA1 586f911a5666183f01e4a99d615824083641d27d
SHA512 f522c7af8ef52d2dca1947235c3a5301be8553a0a89323922cd121715601a25df472de7512c77ae44e389fd3fe4e3f3c2031633f5dfc443116609aed989b8b04
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8cec4cd072d55f691628166f01cbcb851e55ad7423f179237a0d44e80c225d31
MD5 147ee1a986114445fc73429ed8cbc012
SHA1 f363c410ce86140f78884b62660d90100f08d25f
SHA512 390f962bdf795ab56e8759220a78277346dfdabdcd5543d3a33ab8678109ff941438a69cd0c615bf54c47cfdbc5f25816d56cb479aeb87e34e642464c6bbdc3c
SSDEEP 98304:dQRQyi36YOcPhLvw2gAf+PN35rgTFlF2:UQyiKahX+PNpsvF2
TLSH
T1B6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0dbad468b2f169acd7ca57abd71701c82b0d7e6c8a425809e5641cd17f36ddee
MD5 bbf144f09c35afd81fc05f4a44c124d8
SHA1 79f289d136fecb51829ed6168253bcc584445b62
SHA512 4f05799d498e417bc6279b26748c2af4d03979dd185be071cafab23ed88f77e8e97c6e81726e8b8d9dacae0e72a3cec22f7d97ba62eb79d36772f076fac70950
SSDEEP 49152:/B+taZ3usBWOBr4tEG20bqx0z+n217aau1glGkrgTFSAI22g:Bu6JmUxd2dxrgTFlF2
TLSH
T192D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4808_13435252529210790.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4808_13435252529210790.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5848_13435252529173787.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5848_13435252529173787.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2a16f1245896a8ab8e63fe9b604acb01c061395e8382572d95c7c6b9da31b235
MD5 9a3cfe7471f3be57ac02cb7a6337838d
SHA1 ba51060f6e1d6b43f6b7020637df68481d10b761
SHA512 809bc8996c77263996dcb6671ca3029bf8e9c10830a715e96db40bace61a4bb052ce6a2dc48902157e52903ad00231fb4829db018bd30d8c44201750f5e7330b
SSDEEP 24576:ocP4mcvIjkGOxhKP2l71nNKbrh/8KBvkzHSdTCQSMbnAqMtdcVrvO1:TP4m4IpOO67W8KtkrgTFSAI221
TLSH
T16A65AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933C3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 f1786e3fd85106a317001b2b73b6345f2ab0cb80b599e2bbd94125091a3cd482
MD5 446021cdc65669a12999f48b20a86efe
SHA1 bf59df91c24bf422cc3c62e868710f0b8cee0c89
SHA512 618dcc54ed18c58458296a4ea3aae792eca3a04db3dda8a39e924d3e904d4e4d347ad6b4b5c929a7fb21d78eecb7aa7ddca9705daeb76244e4fb05fe91a8f7ca
SSDEEP 96:sJCaZzMrONmv4lE9lhK3BK3EmLljsfcAihK2OK2rPMqALl/8:eOvvLelYjfcl2l/8
TLSH
T13AF1EE8AAE02487F3B868B3B338335546E6F2419D7D4947277EB6552F0CE9A5001F5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 97c3b24e7d3bb19f6d8047bf2860d49362b2c69f60f760bf5bead06039e5f17c
MD5 113c4a15c60c3d01bf0ce1a37c984f31
SHA1 1713846ab4ecbf8c93cf3098b37534dd7fa667cd
SHA512 c4254a61a0de289594c70d9b6603714017b21bf1e8489f23450ce2ccbad59f47d609a86a98e6eae3ddecd0110d12ab8ab107536480dddbadfacf0324243c072f
SSDEEP 96:sJCaZzMrONmv4lE9lhK3BK3EmLljsfcAihK2OK2rPMqALl/IwkJhhK39K3YSWk:eOvvLelYjfcl2l/WSxq
TLSH
T19222BD969F02487F3B868F2B339335506D6F240AD7D491727BEB6252F0CA9A4001F5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dc9d4ea1a0d2234ba87172621e2d28d04167e6b25474afb91e4207131ae8905d
MD5 237e908d2570882e7d8f3ce9bb973e2d
SHA1 be26bf703bb84da60789d9e9901766e39fb0944f
SHA512 55a184cc7259eddb35ecfed53a5e0cc1e1722cf835456c888c2127e1fa53000b9d75f8013770fdd81e248d36700dcee2798650c9ee2911370d4cf2e100380f36
MD5 SHA1 SHA512

Submit Download

39d70a72-7d66-4831-9314-e5b22f539755.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\39d70a72-7d66-4831-9314-e5b22f539755.tmp
Size 649B
SHA256 2ce734fa697601f6619f656316a8034b1c104519c13e3665516e7f75d2420965
MD5 fa11278f64939878261aa52b433df7b1
SHA1 1814ad292898a2984a6e9edc05df362b488f0104
SHA512 2c3feef1bbc5e930bd19ca75c5b662b48ec10e215779b4105a85004b119db082aafb1f43652da7ef07e973100a05a6aa9ad0329d43f28ee1fc7de07eb51e4013
TLSH
T13BF0F4A5C921ACAB18FD075920685B86F75113673A81889B3A3C810C8FB553B8689C6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 38KB
SHA256 5ecc4ef3a6c486f228e5a5e1c39d8abfda1596b1788cf12834c76be57c0cc760
MD5 bf3239f05d2bcd0891ce5edb5d1a129e
SHA1 e5786429659a8bc2a3bfb3f32f3ca7843703a7a4
SHA512 fa3525111bfc9c6162653c604a9eb6b34776ce30bd4cb4521d1456b78af525ad75c5804c23aad68c3949597dca4ccb6f57f25a10ed2de94bebb68834dc5e592c
SSDEEP 768:p/JxYJvFC8p8m9Law7KNnHx8jLtK9vfaiOMb/0uEulrZ:VJxYxFC8pC8Ulyincv+Z
TLSH
T1F4030108DF31BFE88BAC92F7A6842230BE0D5351D7376950CA95819D6F9E1202CCEB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\service_worker_bin_prod.js
Size 136KB
SHA256 3d98261dc84b114d5b0f29f2c47fc08ae9ba13b177f100d740e413d5716f5c1e
MD5 9d82da2d26e815161b54d9e21e5448c2
SHA1 8a00f666e1baffdeb5ce0fde0e109bcf111ff724
SHA512 5520ab30df09a3582e7d3ac3fd756b257d0dcc75bf4007b28151f063883046caa4f459125106d46ad99f5bb7f0bfc557affa5750aa51b5d99e43e73cd11c5926
SSDEEP 3072:eR3MbbdKe2KTOtBth8CyOMGL2y6GDiwYxyrxygCpYK:eR3MLRRA2y6GDiwJxlCpYK
TLSH
T1DBD3D9CCF6A5B0124363A5F5402F000BB23AB8B9E44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d2061caf659b747ee33a09e456a730e62be7a0fa292014b3079ce3c06414a13
MD5 1b66de3fadd1035ac4b7c5995ca94958
SHA1 7c61f4bbd5d2c053b62525b502f4e96b62f8fcd7
SHA512 5730a7163470301eb253aeee37be83dd5d9cb49449fd0b7888c04111d9af278814440c5bf7d4fdeb0c3d684ed807f5d206abe89da13a47b7f04a220981112d1e
TLSH
T1ED619CB3C7D8866DC811A6F49B257E1FDD2E0A28522D3C56C8D8EE5F53E2872D21074E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c42a309a42216bb22640a4a35d2ee6570012ffc0437ee11866b792f83b4a021d
MD5 abed59ba6e7382372d36342cd7164a8f
SHA1 7d132cb64e5fe5cdcd43712c39f603d1dc09819f
SHA512 ecc9f2f69f8a4c25672919776f956d5485ab32af6625da0803a5d661c098b413bf3e5aa11788262d99f2e32ecbaa8ece2a8b839673a3c051792d389d5ab5546f
SSDEEP 192:+RwNsqv7K9PRp2SXsb+WNnZm2mGiyIsnAUgtai:+RwNsm6XpXwY2uz
TLSH
T139122E2DAA54B57B5CCED22AE9267657E3F5102234D42E88D7FC892C14D79CC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 aa261185b5d2adec5900a411e0ea0e8592a50525f2a1fe13d1b71723a2a0361f
MD5 ef5ece3d13831c49d0abceda6d742e77
SHA1 bfa6e55d6515ccc1f6cf87550bf8d2354862bbcc
SHA512 634f639ab1f26b3021752851de6f24b2ef480efb7ec2bb5e381a5c41584075d4f9126f9201e6ae63da5a566cb629100ab702b48324119990cc36b5a5f8adcfaf
SSDEEP 192:+RwN64qv7KmPRp7SXsb+WNnZm28u2geL9iyIsnAUgraJ:+RwNRmfXWXwY2D22e
TLSH
T17C42932DAA5079BB5CCED21DF9267B56D3F1102220D42E88EBFCC92C15EB6CD2217857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58a43a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58a43a.TMP
Size 3KB
SHA256 90a3f7a42b51f2609814cf885edd5f7a35c34e4c178a2cbe38d94917804896a4
MD5 bf76be8bc504dfec3d6d2db6c061d009
SHA1 897f8e311b2a200ebd9fb67c38a6514954211966
SHA512 0442061f3f5add4b276f8f1528224f4aaffdd57c5f57d37c5313e861089164dc84946e04b2c0b208a3b97694945059fcbe323225fb1b78e9816f892413cd44f5
TLSH
T10F61301DC4F01DB71DB23BA5782E0781F992163B1584184A7A3E058C1FB386A8488FEA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 571c32f3ca5bcf2702c1361c4731ba02df83e5bd87240ae26407704ef9caa15f
MD5 ff78b855e69d673bff49d6265516d3a6
SHA1 4d2485bcc13013652788b47f51d746fb8f6d2410
SHA512 f0e1bade7964800250e5a05004311dda562a20841dca0884df351232a5222bf18b01dc692c922a4eb254d077da9a43fb7d79a14d2d26616fcbe351941a10fca7
TLSH
T184B0120C80861700C89056B02199514822585E21A4104B03CBD06E85DC630D08366145
MD5 SHA1 SHA512 TLSH

Submit Download

a92a901f-afb8-4090-8be0-ee8614a8164f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a92a901f-afb8-4090-8be0-ee8614a8164f.tmp
Size 11KB
SHA256 aaa1e0b00928497ec72f3503fe02927534c9fb186ade90557a758b35cd51e437
MD5 0b501bd1d9021df729b6a890f7ceb0b7
SHA1 da6d4896d1cc36e6e0df9a1890c4e58af3b6978b
SHA512 7558812292bf721d0011417f37dfbe0e0d48544721adb8b143a1b90610c762c27c6b307d99ae4be84e61c764b19a528f6b323ae8eec2e1a1ef0c1b940d690b31
SSDEEP 192:+RwN64qv7K9PRp2SXsb+WNnZm2Zu2geLHiyIsnAUgraJ:+RwNRmCXpXwY2g2Ye
TLSH
T1C732732DAA5079BB5CCED21DFA267656D3F1102220D42E84EAFCC92C15EB6CD221785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 487be18a872097a26684b6bca32c32711ed5203f922358d43101563d98a3e9b4
MD5 0f64e3287e7052421a2a6963044e4b9b
SHA1 dab08eb303cbd3e10a4ae7d50c1a92b19b00222f
SHA512 e949754ec505e4794277c2847bee1eaa1593114d586e17046a6327d33d6ba83bd4b4f5992636223ecf84ec9bc1abd2aab25e7dbb72691966499818a15f250ca2
SSDEEP 6144:vP+Dvz0p3IGzzZDTm+hFD+7t56OD9ZfSApprN:H+fM4GRPmyFSXD9ZfS4r
TLSH
T1A744123639919C7785B9E150E05FB1348D78DADF82EEAB0984066F8AD29FC0D0A57C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 285c9d0523d54ff603d00ce2e9940c0190318bac65610b45e54f69801705b8e9
MD5 9cac25133aed2d94c4dfd3a6be1f0655
SHA1 db01a8ac3da8b4a6abf3eef9861c9f174aebb6d8
SHA512 b737e804213e3788ce7041e74ffa7e11d971144e0fc6c3d670ffb60e27da76548f173fdb1567f8f82165e1d10335d259a4683d523c4f1c96abf15c3c4658b37a
SSDEEP 3072:0+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:0+hFD+7t56OD9ZfSApprZ
TLSH
T1B6D31232AA91C8BBC9BC6541B197A300DE726CED55DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b3ff5a93c4c539933e80324bce32f8b80bed8a1f706d1dc7a87c00b5015dc4bd
MD5 031b53e3c3def9dab0b367125bf805fe
SHA1 3f556edac67e5f9f96cbf51ea5c3ca9e72288206
SHA512 563bf5a1ecb772ce1db7b61720907e4e0235e10e2ff1ee19b3ec2ac75c85b4d363ad2d7032a5b5c038538d09d81e15aee0ba7d42530be5fd7d88051b46fc75c5
SSDEEP 3072:6f+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gg:6f+hFD+7t56OD9ZfSApprg
TLSH
T114D31232BA95D8BB89FD6541B157A300CEB268ED51DE3A0944465F8ED09FC4C07A3E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 b3105c7fdac887a28897017a95bf57034a13808325e581ee97d6e91cfdf211ef
MD5 0c05900eb243b5679b4e3af67c8abaf9
SHA1 905b7583b896bdfe5da8c5b594361f069673f190
SHA512 b810a9714ed1ed30192cdbb2274681e013be6f176ebfb741610a52fb3370d887a829ecb07b5076a6e17f78d21fb31158b448fd7fe0ff9f4de8fe56331dcaac8f
SSDEEP 6144:lh+Dvz0p3IGzzZDTm+hFD+7t56OD9ZfSApprN:lh+fM4GRPmyFSXD9ZfS4r
TLSH
T1214412367A919C7780ADE050E06FB138DD7889DF42EEAB0944465F8AD2AFC4E0657C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e82517bb-d5ec-4062-98d6-31b9e8cf0a7c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3676_1211056507\e82517bb-d5ec-4062-98d6-31b9e8cf0a7c.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a401afcc665fbf6.bin

Path C:\Users\Admin\AppData\Roaming\2a401afcc665fbf6.bin
Size 12KB
SHA256 2de95f869de18c940f89cadcc13cbf1529cbc5fbb9fd2bb84e6bcb3e6ab92ae4
MD5 a96c9c0eaff64d6f3c1d3c4aabbe41bc
SHA1 ca950c6073e35dbef0dd9ceeef34146db4ad1f46
SHA512 ae6df10f167eefdcfdc90d4ce0d0ed5160542ee4335f1cf7a36aa83f29d42f309baddca2e24e7ffd935b3bb618328b92ddf2d7a5246d9ff32d5311391d31d85c
SSDEEP 192:fcS6hE55S3Cu5XfQ3IDmEU93nHeS8jBkUHDq1qNKnxHyUIatfuUmcOIm:fJ6G5I31VkIDmEW+SYrmlnxHyw1uoOIm
TLSH
T1A742D0368426BDA0EFB4F3CAB64CC904772522460E5D69E3C54DDB281D8A0C3C15EE7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 c3c09a630a44cea30b56de4492c96a7ee9ad69dd3fe0a1f4a201a3a7015e2580
MD5 1162d3840aaeb88e59d3f8d35cbef671
SHA1 967bab82d1893d5052d115f45832c79fca348e9f
SHA512 4ea518ff5b454c5afb2b4938dfe04d9dec339c0997bb0eb8cc5afd4d2f63c866bcc58fbad02340d40c5f160b76971e0bd34a51fc2931510d22f8d306b463fca4
SSDEEP 12288:kyzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HU:knkzHSdTCQSMbnAqMtdcVrvO
TLSH
T149352311872ED8B3DE3685348ADE8587503A3FF1DD90E34BA948B53C16746E6E47270E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ffd5de4dddab1d47bdd1014d69f138ecd36ecb5088ad0c8107c6bb00f1d8485a
MD5 c5f6a2f93ca4a5e2add3166a571cc758
SHA1 9744840cd0c1939a69a538d6fc5730ea7255c917
SHA512 567883f33670b0c7dd2c175cb8166a81b6a233b9504ffe067705afcafdad379514bbfc500ac8869a0e88d499916a052b5039f34c4f2f5ef66f9a1950f8db6c80
SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQpkrgTFSAI22/:7a0hNYG4JwjrgTFlF2
TLSH
T16585AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 213fd56bbe3cd71acd64377ad3d88369839af91ce65abb7526327e19bb1d8a2e
MD5 737b64eae53f63ae09a06b219dc24189
SHA1 539953a7ae055713237a521aaf11bb42bf688213
SHA512 c3e1311aba8543b1444cca4ba8847738b92f7abfa30c1436515fe8812b715a8e1e4fdf865c1ce9a87634a60946215a80d146af26d093e9c8372f102be41c19b4
SSDEEP 12288:DhbHjfXBzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUW:DhbHjP8kzHSdTCQSMbnAqMtdcVrvOB
TLSH
T14345027E16AD20E5EA32D17DC69A8547C231BCA25721A3EF26C1813D0F3BAE55C32F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8a1a9f26af2bdc032abf88a0c71fa38696f19efbb21463bd7eef6cf5bc278248
MD5 072aaaa5624c2fa645ec43c04bdaa9cb
SHA1 b9ea441c1efecae30cb758117807aabc1d474b73
SHA512 e5c7e53379b79c34c1bd4e62b3d0d9a828d18591813723ad0923e4de2f228b3352b82776e659cab5251647e4b2c626eb80597a85b94909490346e4c360fb4548
SSDEEP 24576:z3YgnJcRTk4yti+R5dBR/0kzHSdTCQSMbnAqMtdcVrvOD:zIgnaTk46pBR/0krgTFSAI22D
TLSH
T15445BF2DF2B910B9D8A6D236850147B5FB71782D1F209ACB0170C538AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 a55e5917f4792c323b3daf435538dfd80489aa1ac8a964caa1405d28dd00f561
MD5 9e4510385d467f8e594b40df6f5c8ca9
SHA1 6a9624350aca3b222906684dd8ab7c7f6b182484
SHA512 7f7ee047b584dc0ee2e0f8a511329aadb7d8d69404cfc739ae96b56564a3b3bf6d9f23757d6ab19dc691a2178cd045f0c394a72af58f1bae0c7becb60086b9e0
SSDEEP 12288:XWzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUq:X7kzHSdTCQSMbnAqMtdcVrvOt
TLSH
T196352310862ED8F3CE328575CBDE958740243FE2E691A3D79988F43C16646FBA17274D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.4MB
SHA256 7e043b2fd5ef76ec37e15d28ffde2dc5702eaf0a9e82d46145c868ca6c10c7f3
MD5 f44b467928f4b59e0267c7c6cfd027f8
SHA1 758a3b6ab253402a73d3cd28de323e7518a3befb
SHA512 be4400f0fb4cfa01f487c1fb16996f4a0813b80754e6f65b936950eaedfaa5e14e3cf28b8c3a2eebdf34bdc32e205e505c4d45ab8b116959c989de5df2a4abb1
SSDEEP 12288:RObXA4LWOsvAYFTPzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUQ:GzL3UTWkzHSdTCQSMbnAqMtdcVrvOr
TLSH
T16C65F115E7A540F5ED37C13CC9A68A07D27278990764E7DF03A88A691F537E28E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 999e5a6e45660779074cea786ada40b3ec73473fa7a4b3f6e50f13b35bd79588
MD5 7a1d88f23125b3c3a67fc7605a838fe7
SHA1 d3b072e53414552bdb0c1383ebbe7a8014a90de9
SHA512 52fa9ffc450579c470a5395b963887d2f65a071dad20d9c314782d508ce3c65cc6790aae84328cd0cda5bd92896360bdbbbe6e172671afbb93cdace637ce5a8c
SSDEEP 12288:vpFtgODzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUI:COakzHSdTCQSMbnAqMtdcVrvOL
TLSH
T11145022537AD10F1D536913DCA96824AD371B8A24721A3EF06D0807E1FA3FF8AC36B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3b101b9c6463a506b709f432e76bcb38f7ddea2be8e0032b1aaa64f7cb3f477
MD5 e87101f6122db6e54b6af73899ece1b9
SHA1 d926d80ae0b2746418fb31707fef264921b24553
SHA512 e19e3dd5a40d6a67ca9e0b9720ef5e2184acea0b7afc7955ab7a09021b5d22b4f6bb723625b586b257ab9712575f83b07dc5adae69180ea5a62e4f1386e1395a
SSDEEP 24576:k7NM9YqZqmWMUkPjZM48Mv6bEhsXkzHSdTCQSMbnAqMtdcVrvOs:k7cBWMpPjN8DbEhckrgTFSAI22s
TLSH
T1BB65AE2E6BAC81E5D577D13DC9E28206F6B1B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 51d6ea9f7337eb6a7794fdb58c845e8d76944198cd3560d7a75620adbd653a89
MD5 8e1197b372fb72f5329a5578cbe3b44d
SHA1 1436889684e4fc921d0f72893e7434321630c443
SHA512 2685f9c5705eab43c537b349aacf50f54413773e9d28431f73c705d1f90f7468cdaa587fbc41b87061ccb9dad6d68751e100d6b3f0cc7e661a275a958c3684f0
SSDEEP 24576:FW6BApg2YuyuNDYTabvcdvNYf8km1VkzHSdTCQSMbnAqMtdcVrvO+:FF2YuHNETovAvNYf8km3krgTFSAI22+
TLSH
T1A1857E2927ED80A4E0BBD27D85B7D246F9B2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c364c6ae67312dc5640ef52f836fe70bcb7cfc5b7c4c0613b34619d486a30f10
MD5 1dabb9301fee7f3b7ea397d75fa83a82
SHA1 ea028c0a4e193e6e8acb7e050799a47566003e05
SHA512 8378958650940fd82ad5e07e6b6a23b0603127112bb2b393ea86cdc76d8af71044922b7e2079f568d747f116edb8b28875e1c3f81abe104bdb2a4ab59ce00d38
SSDEEP 24576:pAFs06+OmlfQNXEbTo+kzHSdTCQSMbnAqMtdcVrvOZ:uFs060lcXuJkrgTFSAI22Z
TLSH
T10B65BF2F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 dfcf4764fe9029308297259d95ce9552656312f5bea211bdb71b82db0a9c852f
MD5 101f4b6b87441648ad9dcff8bfef343f
SHA1 da29d4971f880533f0913ef2d1b868fb2ba55dcd
SHA512 2aff3014764f4aec94d4bc0cf3c87f422e12222931d1ef81c0fdd01a0b507257d22c9153460c30f469cb2f36ecbacf5ca92c7251d7ad62d3f0700aa17b67abcb
SSDEEP 24576:oJnJ5D3WUJkzHSdTCQSMbnAqMtdcVrvO1:oJnJ5DGUJkrgTFSAI221
TLSH
T18F65D02DD2A810F5D477C274819A1786FE72387D2F226AC728B4D5353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 97f43a27ef4d213f8e6900d4f44789694d3ed076dfc5ab0bd536872250499dd5
MD5 fb1b13af7591f8120e1642f7cd8f3638
SHA1 c4d63cac6530aa1136aeda455aad87428585b015
SHA512 f814ef5d5a6d8bcf6ace0cf916b7f8d1afebdfeefdb49f774b9206ce58ac38f036b741cc223c1da32a6b93bfc3ac7ba8aa804a78e0ceedaa4d9f0f776d90d5ba
SSDEEP 49152:9g06DIKdwc+eQnSt65aVjkrgTFSAI22y:WSrgTFlF2
TLSH
T134956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 6f6045ef79e419a25901fa427ece6f31162511bb0f84dc814a9147bf9cd7e5bc
MD5 7eee9b442a3d167f1fd6e5578554c845
SHA1 5ab46a5917d2576ff5b1acadfc0d3a88289adf1a
SHA512 01c50d9db7d79d5588b81e2e9bbbce6f86418f31786b6008349a235cef84658ec6024a94ab86f5be7f26f6ffefb9e70c8ea8894915a26dd0e7d897aa9def5d2e
SSDEEP 12288:pEP3R/9zDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUR:6/YkzHSdTCQSMbnAqMtdcVrvOC
TLSH
T1CC45122D276DA0F6D936903DC6958246C372F4B1AB5263EF0690C13D0F77AEA6D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 c42d8e7d02537eff402f640fa484bf6ffd2e380980337dceddefc3261e69f3b0
MD5 d44fcabdf1f85958f1d2de3b8392bc12
SHA1 7aa035c9caf47fa3eb1306f2dd78c3a8b085e006
SHA512 063d74c8ab5d3e5d40e0eff24a2dd3ee2412db1615102266a2f4648de892d252211718fa07d196b4c713ba1d18eef668bebc0a8fefc3aa17fe1b8fa1d88c5508
SSDEEP 12288:DjkyxzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUL:DIyMkzHSdTCQSMbnAqMtdcVrvOY
TLSH
T18F451300536894E1DE764638CAA781C28935BC70AF21A3DF55C0F63E6F76BE5B831B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 d06e106ebfc6e2792494dcba07080485fd09167ed72e9e8bd1266e0324f73615
MD5 0dbda5a5e549d0df0c34990e1d870c3f
SHA1 0e738f7ee5b23d3189547b1443042edc80e4d2cf
SHA512 523bea5881119f1d3e22aeecafc60e1290c4366873a3b64d4e1efebcea99236ded0040c7e46b168d882cdcbf061e5fc15aec6f54126cb26e3feb3dc82e950be8
SSDEEP 12288:HazzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HU+:6qkzHSdTCQSMbnAqMtdcVrvO1
TLSH
T14D352314522AE8F2DE328539C6AE558340313EF1EB90B3EF59C4F4385B656E7A172B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 88c42d5ca9a1ab6afa3da03961b2344a9eb6e890ea73bce66a169b0f621ec930
MD5 1c4a43b38f280652e5481e61046d7421
SHA1 887ec97eae78baad5bee50ab84211612da897b85
SHA512 736119dac16645e04440d172eb16b5ee6619d29f0cebf57b3299c8a0114cab7ca4c790defd0879f6348ff51c739f0d45ed1afa39519547c9cabd3db0e9e0946e
SSDEEP 24576:mQ9MxZKdcz9dw3fkzHSdTCQSMbnAqMtdcVrvOC:mVKZfkrgTFSAI22C
TLSH
T1EC558D2DABE9099AE177D235D5A250C3A633B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 f3872d68db6d7baea38663e524e869394fd3ecfd9d79477b0e625dc2206dd957
MD5 4eb6522113709a102436a7a2f9d4d89e
SHA1 3215938928aa171acc46d39f960c9466d7c4002f
SHA512 caaa4bf490bcd0ac5e0ab8ed340755e49ed1ed164fee8ed6e5c88fc27dfbd873b0716f186b5fc7c434ffd39caceb95fd4a6a798437590c57587f87c427abe891
SSDEEP 12288:9yoKo2RRple9pFzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUy:9yocrApwkzHSdTCQSMbnAqMtdcVrvOV
TLSH
T11C55E01FBB6E40E2E132813CC9858246E673B4705B6263CB6691C33D4F67AE9BD35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 202378a6731123e6ce0d4b1b9687f0c225f11fcf78ff3088eacd830b03d90bf0
MD5 dc7343ba87f59c738b9f2df28b781b2a
SHA1 aa82c259101daab14c155a63f311ad813801dc71
SHA512 47cfe5d8dcd2f2a2834ef3da03f71fd4cacb2bf52cce1b86fce01b57efe6eb5b35854f5e234d2a738e8c40d51062a33f4943b54f62baeaa6aee61b457466272b
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKwkrgTFSAI22C:R0zuNIBrgTFlF2
TLSH
T1B7A58C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b5e40942c560f3e514b36fc478138f43e4885cc9a29e5f50434db9eb1bea7bee
MD5 9db9713fead676b7b4cfc252737eee79
SHA1 46ef291d89f1cf8cc37f4e1db8c344f81c9454f0
SHA512 1d572e2c2afd2c5dbbe1f70599cac6c4d284a39d48c0c772fa6fc968abf1d3d375b3d7e278d5ecdf25acf6952b0d60f0c303e6f098e6dd1447c88331e53d2edb
SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYsjMqb9kzHSdTCQSMbnAqMtdcVrvO6:5TDxR+N5YzTujM6krgTFSAI226
TLSH
T1F455B02EA7F945E9D17EC5798B23C502FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 6a8a7ebde5b871fbdcaf360bfe5ad22c75cbcccfa8a525a9114792d8d93debe7
MD5 6c2641c9a67923d59d580975aa6c75ab
SHA1 8497da48f080498040bf09e74e004730391cc768
SHA512 a0229b53c51977b78a676f618d59b72eb9572c494a231dcd7b791579c2f17c118d780d06249a1f899ab113f5d93d25aa841d4738b00d505d0350ceca7242077d
SSDEEP 24576:pTMdOz0FFS+JmSLxkzHSdTCQSMbnAqMtdcVrvOB:j0K+JmSLxkrgTFSAI22B
TLSH
T14065E13EA36D14F5E53BC27DDA478906E57238A20321A6DB0690C17D2F5BFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.1MB
SHA256 4f8c869b72f784057677740cbce1db0b761b3cb91f0fee3d0cf6a5c88927d5b8
MD5 c246e54c442354cb1b56d6f1a2dcfe0b
SHA1 5980b97fdebd6b08ed35c8392de0d8992bf8755c
SHA512 2753452052e34c31252c0eb1cad344abdfb2b3f48a05786e3653e956e7bdbf4cdd92a76161b3c90af61d210ca17a622e1b944351791d69cb1255b9e8d6579004
SSDEEP 12288:z4iPzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUB:3WkzHSdTCQSMbnAqMtdcVrvO2
TLSH
T1CF45121953ED74F1E9328239CBAA41868030BCB26760A3FF29D4D53E4F366E5E531B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-89-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/64-71-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/64-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/64-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/64-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/404-168-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/404-401-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/640-165-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/640-156-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/640-162-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/640-386-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/696-141-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/696-321-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/1240-171-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/1240-91-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/1360-177-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1360-435-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2016-453-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2016-500-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2016-447-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2024-34-0x0000000140000000-0x000000014012B000-memory.dmp

Download

memory/2024-136-0x0000000140000000-0x000000014012B000-memory.dmp

Download

memory/2024-41-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2024-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2360-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2360-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2360-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-164-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2408-115-0x0000000140000000-0x0000000140871000-memory.dmp

Download

memory/2408-20-0x0000000140000000-0x0000000140871000-memory.dmp

Download

memory/2408-11-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2408-17-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2428-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-102-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-176-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2428-104-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2492-29-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2492-132-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/2612-26-0x0000000140000000-0x0000000140871000-memory.dmp

Download

memory/2612-8-0x0000000140000000-0x0000000140871000-memory.dmp

Download

memory/2612-6-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2612-0-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2652-133-0x0000000140000000-0x0000000140117000-memory.dmp

Download

memory/2652-188-0x0000000140000000-0x0000000140117000-memory.dmp

Download

memory/3364-174-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3364-172-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3520-152-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3520-150-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3520-366-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3520-144-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3760-120-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3760-180-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3760-107-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3760-113-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3788-181-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3788-499-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4056-189-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4056-519-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4080-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4080-137-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4080-193-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4108-236-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4108-194-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4108-843-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4108-879-0x000000000CF00000-0x000000000CF08000-memory.dmp

Download

memory/4108-203-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4108-219-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4196-127-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4196-122-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4196-184-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/4196-129-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/4648-502-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4648-185-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4808-464-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4808-437-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4808-495-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4808-442-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5020-56-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5020-92-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5656-904-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-896-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-919-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-917-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-915-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-914-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-916-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-913-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-911-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-910-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-909-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-908-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-907-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-906-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-905-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-900-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-899-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-898-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-897-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-918-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-895-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-920-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-912-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-902-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-903-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-901-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-890-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-889-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-892-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-891-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-893-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5656-894-0x00000256DDD90000-0x00000256DDDA0000-memory.dmp

Download

memory/5848-465-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5848-458-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5848-497-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5848-868-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5936-476-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5936-501-0x0000000140000000-0x00000001406BA000-memory.dmp

Download