e5b790c3a237edc2c55f01a7c648d0eaf8e969a1a9223aff605a90a1d42900b7

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe
Size 1.1MB
Sample261017-dfapsagw2j
SHA256 e5b790c3a237edc2c55f01a7c648d0eaf8e969a1a9223aff605a90a1d42900b7
MD5 f131d1cdf3849e1b627a474bd9460acd
SHA1 dd81532c0e1a95c35bae0ee0bb5b602a13fbfeb0
SHA512 462764641aba3eec19ce57b881735b40686f5e3f00e478335ded2b2003ec39d4e96196f73873116a403b48c1dd704798c95a7447f1127917378b0d2f7211b6ad
SSDEEP 24576:bdjTygYizOMr8LquNz5vzGNQML3pFtiW:xj2gF4mEzpSqM
TLSH
T16135E015BB844DFDF0E2897443416932DA61781ED7E056EB028C5B2ABE265F1ABFCF04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89
PID 3280 set thread context of 688	3280	Explorer.EXE	89

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\bader\syniuntlyourds.txt	2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
688	chrome.exe
688	chrome.exe
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
688	chrome.exe
688	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe
Token: SeShutdownPrivilege	688	chrome.exe
Token: SeCreatePagefilePrivilege	688	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4568	2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
688	chrome.exe
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3280	4568	2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe	56
PID 688 wrote to memory of 4388	688	chrome.exe	90
PID 688 wrote to memory of 3336	688	chrome.exe	92
PID 688 wrote to memory of 4716	688	chrome.exe	93
PID 688 wrote to memory of 4716	688	chrome.exe	93
PID 688 wrote to memory of 4324	688	chrome.exe	94
PID 688 wrote to memory of 4324	688	chrome.exe	94
PID 688 wrote to memory of 2740	688	chrome.exe	96
PID 688 wrote to memory of 2740	688	chrome.exe	96
PID 688 wrote to memory of 1800	688	chrome.exe	97
PID 688 wrote to memory of 1800	688	chrome.exe	97
PID 688 wrote to memory of 2500	688	chrome.exe	98
PID 688 wrote to memory of 2500	688	chrome.exe	98
PID 688 wrote to memory of 3360	688	chrome.exe	99
PID 688 wrote to memory of 3360	688	chrome.exe	99
PID 688 wrote to memory of 2096	688	chrome.exe	102
PID 688 wrote to memory of 3108	688	chrome.exe	118
PID 688 wrote to memory of 5072	688	chrome.exe	119
PID 688 wrote to memory of 2976	688	chrome.exe	120
PID 688 wrote to memory of 4852	688	chrome.exe	126

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-16_f131d1cdf3849e1b627a474bd9460acd_cobalt-strike_icedid_ryuk_satacom.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffaac9ec728,0x7ffaac9ec734,0x7ffaac9ec740
    3⤵
    PID:4388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,6907264536665950651,17705266875237946822,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,8391546471290617091,13075448346487979123,262144 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:4716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11773174909859469645,16449555012364960685,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2420 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,11138242305708979559,1709614577390575432,2097152 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,18350358826554392233,14341218836424160262,2097152 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4008,i,2839336696852377840,2229849143335898413,2097152 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4020 /prefetch:2
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,13172283525676322532,6042836607528995638,2097152 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,17440953661978868099,10577888928824445692,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:2096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,2632736020028130622,7787400929618380188,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,3685375582850989179,7290923202741842694,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=220,i,10145137347353030155,583984751936803873,524288 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,11348995660123348106,3808131255345449505,262144 --field-trial-handle=2056,i,4128068666872161990,8271754718644916355,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

189a2476-5f2c-4127-b394-b657c5fdd889.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\189a2476-5f2c-4127-b394-b657c5fdd889.tmp
Size 267KB
SHA256 6dd7ae933298d1932b590b0bbfb7a5c3cb12110f0551e26bea67250713e7c601
MD5 a75292980252f0d9e05820bc733cd290
SHA1 3d5a396fd425a7fa7986085f6b2b7698e4c381fe
SHA512 be68a648b73a168a097b22b0a13c44bf2612b57b7460b7561663ce6ad23d83f8461f92594a8ba5ea7735b78f7fe41c656dc90ccbdf0908e1e8535fe19a242f3b
SSDEEP 6144:qEYmomo7cEQQJE7iR0IH6sdkxoGNKS+hFD+7t56OD9ZfSApprJ:K3hYfQIKSyFSXD9ZfS4X
TLSH
T1B2441372E500DE6B4A745604B02F631DEF62A6E9D68E1F0981866FC5D1BBDD84323A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80459060-a31d-46f0-bc38-08444f1ba447.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\80459060-a31d-46f0-bc38-08444f1ba447.tmp
Size 130KB
SHA256 9fde6f5945588148aedb730a5c19df82d30746d17607f28496fbd942a17e72b2
MD5 7da18d834127d3aae4fda8ddc5556cb4
SHA1 95ab31b2511f33bea0ab7080ed1569aefdb259b6
SHA512 57004634e7b5a1ca324d4fa68d60607f79732991bd32908101d929d05a84faf102223d6bbe33a6eef121f336810a7ebc81c94bf334a047a84d3cbf2778706e8c
SSDEEP 3072:wJj+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:w1+hFD+7t56OD9ZfSAppr3
TLSH
T18DD31232AA94C8BBC9BC6541F157A300DE626CED55DE7A09444A9F8EE09FC5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

975aaa38-bf20-44a5-b26f-c23e40bca0be.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\975aaa38-bf20-44a5-b26f-c23e40bca0be.tmp
Size 267KB
SHA256 fa5e0090fe66b82447f41ae56614d5004e1142fa7679131e9d66d079780295d8
MD5 b22360e7a6d805b3b0e484313995d746
SHA1 09cd2049c69f07bd8cda3ab50f454eff8e895ed8
SHA512 d5e2b4308027fe5d8d8e61575dc88bb830e48a59cc34a4e5c3c5aadec92adb973c150514ba582df1ea992c28d706301020cf2c50e65e047f8e59b1a4c9e538ab
SSDEEP 6144:hy8Ymomo7cEQQJE7iR0IH6sdkxoGNKS+hFD+7t56OD9ZfSApprJ:E3hYfQIKSyFSXD9ZfS4X
TLSH
T114441272A400DD6B4E705604B01F7219EFB1ABEADA8E5E0D81466EC5D1BFDD84723A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10785d90-c1a5-4d1b-8f6d-cba6f2f063af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\10785d90-c1a5-4d1b-8f6d-cba6f2f063af.tmp
Size 12KB
SHA256 796492d134e0a6608d51ee67617671004b225baaaa1d905c062fc71903effe2b
MD5 0bf70c09e8198618a474b07094a32650
SHA1 b2093e746e327c89ede25a92d634b5bd7a9244ce
SHA512 607b15b1e9936cf72ac33c8feb30f439bebabb0fb0f0d97b083e95b38fb2137f83db7a26139e20adf9d5d9b61b994f8bcb7e1b397d3409ff1908fcce8ae634df
SSDEEP 192:zRVLFuQEX732cAv7VJpAPRp2B9fHsb+WNnMF0ci80VRVyIsnAUgtaJ:zRVhDdccvUXGhwo0cHM8
TLSH
T16942932DBE10793BACE7D31AF9613753DBF6202125952E84E6F8C93C25EB5C92217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91c171f9-2c39-42d6-a0b2-d3486f7afde9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\91c171f9-2c39-42d6-a0b2-d3486f7afde9.tmp
Size 414B
SHA256 5a8cde331c06146c8ff71106fb2ee499746dc213d60e503fde95589d27898d2d
MD5 63570871dd6d392082514c9f2049f721
SHA1 13ac6e0aef2467eecc4093ab6e382b014a27b4cc
SHA512 4f480a69eeb4462072a191adc229fa83d6f0f72f77f06087fa99aae21412c6310f45e00332115b752261eca0ae9f9627018a3a54dfbddf81f84eb5144db77d6f
TLSH
T1BCE02BAACD60AC3718F80B3950901746EB6113572E51954BB73D820D8FB4677828685C
MD5 SHA1 SHA512 TLSH

Submit Download

19792116-2a52-4f0c-9f5c-bc3654b91ffe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\19792116-2a52-4f0c-9f5c-bc3654b91ffe.tmp
Size 2KB
SHA256 e513ce671c82d08d7c2ecd4e3e8e026d27e2778f66c5a342d115c4bef829c269
MD5 35b9080b52b6826bc2120a72d0fc29e5
SHA1 4385798533e9060ef8082ad2bff461f35214c711
SHA512 116936f8aaf8cfafbb9cf5054ca5ee1b08dca53f22d9c40d7a4754c49a42f34a6366e338ec426a8f0b648a4df7994af2eb8abfeacc47f3eab62004d120830c9f
TLSH
T128519EF7D7E88A6EC51156F49B217E2FCE290A24021C3C66C8D4AF5B53E2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

3502a63d-7f0d-4b99-b1a2-39fd24076a62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3502a63d-7f0d-4b99-b1a2-39fd24076a62.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e6aa77d77870b70ae898f65d22b1371829b16797dd531b9911ba73620ee60457
MD5 4a60834a628b37ad4f7391546b3102c4
SHA1 4d3a98a424f49ba2eaf3f86f39cb935f811f3f95
SHA512 c1e1b1c6d7c3db14259e92c053fd7a6a1e927aab5861ce05a8fd3be2747872d4281c3a4d9e5f923decf215a361fdb58c6fe75efbbf9d785e521bbd748d87c928
TLSH
T168B0125488465302C00302F411D424C87158EF20A605130151F00E119835560801F064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f2d0fd9f4e51c691957d3aa22a99a5a3f756e20c5715cef421ccfc7d640b1dae
MD5 cfc82c56efee8dcaa77bcd4b15f44517
SHA1 ae77e3c4ee305355117a716e3db02eee20c23e80
SHA512 f796a2f98743fe0461bcb0b2a9bbb0b940874c662a277336e4e943e6c262c3bb2cdf689772d00faddf5bda00e90043537840f05b40a94d912435f8d8cf91bd53
TLSH
T146B022ACC0023302C00203B03AC282C830A0EF20C203230A82E00A23CC2A2A3002B220
MD5 SHA1 SHA512 TLSH

Submit Download

e94ab475-97f0-4bff-9b2a-49a69006d174.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e94ab475-97f0-4bff-9b2a-49a69006d174.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f86ef6b0-8f7e-471d-a1b6-f7a3f65d65e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f86ef6b0-8f7e-471d-a1b6-f7a3f65d65e5.tmp
Size 267KB
SHA256 ff3877bc0107bb2db4b08ea2038363c538a765572744601d866ba02871e1cf92
MD5 99a558753b14c1e4e37b98dc0c6894da
SHA1 4d9b6d5327280a571694c3d0a76cd86bc3e394a5
SHA512 d405dc3617b912348ab3ec7dc43baf2a86252462f3e575abf2666ce48fc4941f659bfdf501c8a76791c0797af60e911ac883062d403a5494cb737c3a2286af64
SSDEEP 6144:hEYmomo7cEQQJE7iR0IH6sdkxoGNKS+hFD+7t56OD9ZfSApprJ:33hYfQIKSyFSXD9ZfS4X
TLSH
T106441372E500DE6B4A745604B02F631DEF72A6E9D68E1F0981866FC5D1BBDD84323A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-135-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-7-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-11-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-8-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-26-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-21-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-19-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-18-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-16-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-15-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-10-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-9-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-30-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-31-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-23-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-24-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-27-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-28-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-12-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-90-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-13-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-2-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-5-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-265-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-115-0x0000000002F00000-0x0000000002F10000-memory.dmp

Download

memory/3280-114-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-113-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-117-0x00007FFAA6B72000-0x00007FFAA6B73000-memory.dmp

Download

memory/3280-116-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-118-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-120-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-119-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-124-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-123-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-122-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-121-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-125-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-126-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-133-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-132-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-131-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-130-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-129-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-128-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-127-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-0-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-138-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-137-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-136-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-134-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-22-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-140-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-239-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-142-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-143-0x0000000002F00000-0x0000000002F10000-memory.dmp

Download

memory/3280-6-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-1-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-3-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-182-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-183-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-185-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-186-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-184-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-189-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-188-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-187-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-191-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-190-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-192-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-193-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-195-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-200-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-202-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-201-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-199-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-198-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-197-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-196-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-194-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-205-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-206-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-207-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-204-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-203-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-208-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-4-0x0000000003180000-0x0000000003221000-memory.dmp

Download

memory/3280-141-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-139-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-241-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-240-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-244-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-243-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-242-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-246-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-248-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-245-0x0000000002EF0000-0x0000000002F00000-memory.dmp

Download

memory/3280-249-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-250-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-252-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-258-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-259-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3280-262-0x00007FFAA6AD0000-0x00007FFAA6BD7000-memory.dmp

Download

memory/3496-112-0x0000025D58E00000-0x0000025D58EE9000-memory.dmp

Download