6a109bedd39b9c9137041c5afd49e919760782406fd97bd1a544a91a7601b6e9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 8.5MB
Sample261024-tt6mdavydz
SHA256 6a109bedd39b9c9137041c5afd49e919760782406fd97bd1a544a91a7601b6e9
MD5 39a26cea26ffad338e6b9d3197c1eaf8
SHA1 c7917cd4c0288b84a425126063955f7598446e1d
SHA512 b13fe30f1ba0ad261226ee7ff2f2dfc1433ec6b87cba59afcdfd6d57528746854c97db1357e23bae3f7b5c34d682bc4d26e4d3c1cc248f03d1dc5e44ad733f17
SSDEEP 98304:Du3E1KOwgBNfsmDvo75nMrqC4vdqCVDC:aUVXz8aWxdJV
TLSH
T184968D13F2A601E8D05ED974CF3A56329A357C4A4BB0A2EF19D436A11E75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
5164	alg.exe
3760	DiagnosticsHub.StandardCollector.Service.exe
1548	fxssvc.exe
4364	elevation_service.exe
1896	maintenanceservice.exe
3792	msdtc.exe
5376	OSE.EXE
1720	PerceptionSimulationService.exe
3300	perfhost.exe
3460	locator.exe
3520	SensorDataService.exe
2388	snmptrap.exe
3812	spectrum.exe
2444	ssh-agent.exe
5024	TieringEngineService.exe
5260	AgentService.exe
5236	vds.exe
4032	vssvc.exe
4128	wbengine.exe
4672	WmiApSrv.exe
4208	SearchIndexer.exe
2972	chrmstp.exe
5268	chrmstp.exe
5196	chrmstp.exe
2924	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54a0602a227ba850.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5932	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e64ccde5d363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aafb99e5d363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080e3d2e5d363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fea24de5d363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc6580e7d363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067cb35e5d363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5489de7d363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5152	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4924	chrome.exe
4924	chrome.exe
5976	chrome.exe
5976	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4912	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	1548	fxssvc.exe
Token: SeRestorePrivilege	5024	TieringEngineService.exe
Token: SeManageVolumePrivilege	5024	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5260	AgentService.exe
Token: SeBackupPrivilege	4032	vssvc.exe
Token: SeRestorePrivilege	4032	vssvc.exe
Token: SeAuditPrivilege	4032	vssvc.exe
Token: SeBackupPrivilege	4128	wbengine.exe
Token: SeRestorePrivilege	4128	wbengine.exe
Token: SeSecurityPrivilege	4128	wbengine.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: 33	4208	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
5196	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 5152	4912	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	84
PID 4912 wrote to memory of 4924	4912	2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 4924 wrote to memory of 4372	4924	chrome.exe	87
PID 4924 wrote to memory of 1444	4924	chrome.exe	90
PID 4924 wrote to memory of 1444	4924	chrome.exe	90
PID 4924 wrote to memory of 5932	4924	chrome.exe	91
PID 4924 wrote to memory of 3096	4924	chrome.exe	92
PID 4924 wrote to memory of 3096	4924	chrome.exe	92
PID 4924 wrote to memory of 844	4924	chrome.exe	94
PID 4924 wrote to memory of 2012	4924	chrome.exe	95
PID 4924 wrote to memory of 844	4924	chrome.exe	94
PID 4924 wrote to memory of 2012	4924	chrome.exe	95
PID 4924 wrote to memory of 5516	4924	chrome.exe	97
PID 4924 wrote to memory of 5516	4924	chrome.exe	97
PID 4924 wrote to memory of 1900	4924	chrome.exe	119
PID 4924 wrote to memory of 1900	4924	chrome.exe	119
PID 4924 wrote to memory of 5020	4924	chrome.exe	122
PID 4924 wrote to memory of 2972	4924	chrome.exe	124
PID 2972 wrote to memory of 5268	2972	chrmstp.exe	125
PID 2972 wrote to memory of 5196	2972	chrmstp.exe	126
PID 5196 wrote to memory of 2924	5196	chrmstp.exe	127
PID 4924 wrote to memory of 5416	4924	chrome.exe	140
PID 4924 wrote to memory of 2976	4924	chrome.exe	141
PID 4924 wrote to memory of 696	4924	chrome.exe	142
PID 4208 wrote to memory of 5960	4208	SearchIndexer.exe	143
PID 4208 wrote to memory of 2836	4208	SearchIndexer.exe	144
PID 4924 wrote to memory of 5976	4924	chrome.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=156.0.8078.48 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x290,0x28c,0x2d4,0x288,0x2d8,0x14075e5e8,0x14075e5f8,0x14075e608
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93095c728,0x7ff93095c734,0x7ff93095c740
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,662239092361890815,6520817753078475426,262144 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,8659648863110790792,3930103131980223560,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,10563039327577063084,11771808834254279198,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,2408989450622751523,16448133954840118639,2097152 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,14157815870896557874,3827171566481065517,2097152 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,17685704224098439275,10227317825806039444,2097152 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,15145524395364710898,991715474271248277,2097152 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:1900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,4997390663867382745,7543551692876923050,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2cc,0x2d0,0x298,0x2d4,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:5268
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5196
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x29c,0x2c8,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:2924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,6523304189233624531,14877035612014285549,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:5416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,1094680501406967645,273164632388483060,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:2976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,5863617454294921816,16926671235483518923,524288 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=936,i,1130837856783881151,2217233214054623075,262144 --field-trial-handle=1992,i,928442813766722403,10693947570829711817,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5976

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
PID:5164

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6136

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5376

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2420e2096ea0c0342a8e568a3bbde1ba76e3783a45abfc5250f005841368ef0b
MD5 da268e92d2882f6931683fad27269711
SHA1 aea14b7139a1cf001bec2351f26e0e9c03e33756
SHA512 15733329109ec01bbae5a842fde418b7a44ead3f6d6a22e5e30c9a89065afad23c96d87d2e11277c585ee8dfdcb95c0244a13f32514d8f62bf8928c2e7ff7cd9
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5cqydVmeCVg:Y3q6sjBhqCVDC
TLSH
T16ED58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cd95c1d61d43bac5aaadf759952794170f00f1bc915b98497ec93620dd534871
MD5 6491b1c596c2a15af3c9b512ea4b6987
SHA1 b9d422d56222c59d9568985b79dbe8d6fa639057
SHA512 d579bb6d3c440ce584a6ceaeab3d4d8fd66eb62e1b8f7077fe979129d93286237308cf14eb069b8ce64a6b7fb2d7e9c8456b9032fdf7234ec89a233f42ac5b81
SSDEEP 12288:I1XLsswWkxy2lRq2czA+AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAex:uXYfDtczA+AhqJMZfVBMLeCT8qhKK
TLSH
T1F265012967E509F9DD67823DC8B2C411E673B8914360E7CB03A48A2A1F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2c41bab0c77be0b2c0533d7bee9b0e2986c1f6c46b38103336ff4f5ac829fea8
MD5 dce15a8e7ebff6c5561d428a3c123106
SHA1 efecfcd47c08ea548c37bccd209bd3936ea8dfb9
SHA512 9753aac5a044ea463580884f323d66b6c13304ad5e6bcb02ec398dd170b0170bdd54334881e3c2b1fc5a4b19e6f6f82b5f68668c8b877a3ac78ed37f609b80b5
SSDEEP 24576:l0Le5ji0hmxxrMRAhqJMZfVBMLeCT8qhKK:lPji0AjMcqydVmeCVg
TLSH
T16C85AE16F6748735D073C0B9C5D2A68EE972308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5a4821bf0d74cbdf00caf052025d84674f35d9f0ba7b33767572e41970347035
MD5 7c70aef90b45463dbb4b98645553eb9a
SHA1 5c404a899fbcadc13e6d7f80ddd9b47f7b560050
SHA512 4f8d77fcf42b6bd5762ca270fd3606086061a16111c6e168e4b0763b3db7af173e3c77e07481b65bbc41b7ae9c7d1fa760eed6c6ba84e7c8cf2daa9f8a6d4e87
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuDAhqJMZfVBMLeCT8qhKK:+/ezSC6vUzPveHjyQcqydVmeCVg
TLSH
T186755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2a52a13637cd5c5053107ab3afc75307bd58e39869b14970edbfcf54267e8213
MD5 6b980efbb34c0f372066c2c9a11f80d0
SHA1 ccc249c16118ec5083504945b4a786ab0ca34c78
SHA512 71227e1c61c1c8106687b1d0f547d2bea0897164b484747eeb1261ac67561bb1c713a2382cd384d289c4f88719a26ee0ec31c2041b4ea3eb9da06c64fff74635
SSDEEP 24576:HVbqPb88hv/l+YaAhqJMZfVBMLeCT8qhKK:HVO88hXl+rcqydVmeCVg
TLSH
T1F9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4b89e10a99edefe233f721350f2e51af2fc9b203487a7331ec78ac3051647478
MD5 98315b3b27dedfeb3f04f215546adcae
SHA1 f1e9978d9452e1a04e82b848f5f4f6434e53fd59
SHA512 b93d3d45e4193783fdce3b3ca31a5095a116e740b5022ae64233f9128132616e3fcb8e4fb754d10d7d66aec635fc183b620dd32838f81f7e482a29a1ef53944f
SSDEEP 12288:rLdAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:rLdAhqJMZfVBMLeCT8qhKK
TLSH
T18F45235309E909A9CFFA2A7631B8F8D5B2D19DF0E250E242C20A6B6F9CF4DD4D933150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ebf878d63d3fee7eb052ea5d990f5e936f50b1299396ad42c5cbe1f375797b7c
MD5 8aa2a844ea8a012c93b6b509679c6eb2
SHA1 fc966a8bf76786644ef7b717dedc2641b562f377
SHA512 623247cc69cda8c503287089759099b5cc744817c0513100176739adb4855b5baef0e607af2cb71b6ea916b69a047de6d945610e24548eb5b2d1f2e863ef370d
SSDEEP 12288:TeBNUbTVO86USAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:TJIUSAhqJMZfVBMLeCT8qhKK
TLSH
T19C65D03BAE28FCD2C27E5DB95691C640E37278704B61A3CBD165830EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4c3b0d28504feb8a2aa07831f391e702c1de6f267f3e0b1994130e4ad4f48eee
MD5 f73172bf24ca84066d5eb213cca212f8
SHA1 b4521e7efad9e7352d9a91a24a670e31089ba898
SHA512 c28147eb28eb9f261902c355cce77cf0121341b0f51e75762bab7cb475dc3ab2f18e3ef8b4f11d93b08f7231e3be4e5fdff1f331fcc6c0a49ea5616533629a08
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:cQvGAdlCEL8c/DRNw5CoqCVDC
TLSH
T1DD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4fc045733eb8a6be03130f455108b1704cbc9886b34ce70c56ce29f576b5673d
MD5 5b72e38bc7d56cf02948887337e9ea1b
SHA1 72db5693cab915b6084c585aa8f43080b0a02eec
SHA512 f0385c1281d3bdb1ca49bf1b1ba86083b65a2688e206ab2c735f03110a88ac65a9392cdfdda04fa283bfa82f88410b1186917da63c58d73c5deb4505ca4c1aa5
SSDEEP 12288:2AwSfxL/2Dc3RDLLmt0LDQewsAj8AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CK:L0ewsAj8AhqJMZfVBMLeCT8qhKK
TLSH
T17275F031FE74D036C7BF0DB22B35D716246CB9604B611AC3E3A88E9E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dd3aea706fe61cc12f6eaa67800b1670a43ea4e2cd9277b13e9129a62713f7d3
MD5 d9e4937703d269102de0b5b0fc78b6af
SHA1 35b7a89eecab655f7d9b83d31f7fc3212fe59c4e
SHA512 7b7a84ea7b300cf5450551b982a30de1ab26aa7ab27d69c8c6fd780be5da63258a2a2e43ec4f07a2d581b6fe119779649ab9aa880a08071fe64bd66eeab782f7
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfJV:EUEtQevvqc2W1cpV2tI32h
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f075bd194b343dd84b9ba08156d7c44896b612bb18106e87d4ee71371b255d77
MD5 4fa3d0f4d71272616d21fbabe115d396
SHA1 fa5e99e93104b0709b2681451c84a83fbb8b9027
SHA512 7a2ce33d6e23f583051011f62b01a355b0105b1c568243352767da0ce2aa68c4b21850dbfb9ff2bc7a082bf951270ced92942d7340feb184d9a4250e03dab044
SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/zccqydVmeCVg:ToquVjnmcqCVDC
TLSH
T171D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 45c27c173ea175e650f498e0b5e9d36396f9427b490aa44f17bad2aed2e741f5
MD5 26251f63d31dbf86a03075f87ca1aa44
SHA1 6a2926278f0b0929d6ec23a17ca7cd8a6e2643a7
SHA512 52b4ff5bd89e8e944bd79b344aea674d262f801a2dbc1d67ca841d327158072a9942199846cbb74a626d9b475c492fa7d8d9161b97161f4afaa437d441e1c681
SSDEEP 24576:qAhGL3IFoiwtA5l7S53HAhqJMZfVBMLeCT8qhKK:qAMUFoiq5XcqydVmeCVg
TLSH
T1D4359D81EBF945D4F5B3AA7899B69171EA76BCA65E31C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a1bb14ee1a447755f1d9fe0d6270100f4fc099c20af0e622342e1702f43d684b
MD5 9eb62c6f947e536089e60765b485f8cb
SHA1 7895375d11a22c8a9e6fff28ef5fe4cb2679b856
SHA512 41338df54681657f3eff7aaa28b4a1be450b60d6c7f9e05fbd114dd4001efca402882615b7cc9062b4105c389a1c38bc4229d4e08442f0a32f9c44bdb8ae1c1c
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CjAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhy:vwu4OWwAhqJMZfVBMLeCT8qhKK
TLSH
T1AB65F14636E90CF9EAA792398597D136F3F2B8112621D70F4360C75B6F73261AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c6a210b3877ca91989f5d7e77d653d0a353fcbcf16df6f35457a875c45fb1d25
MD5 912c7a04fc63d3aac91644d05c5ef21b
SHA1 40590d6149edc9b8333035be7ae8c7fb1738bd1f
SHA512 636096f4539050f02e64a09fab3258cb38a3220236d406b7d83eeed47fd18ba0f9a291275c74c6ef700ffd7657b660dc7600e82c51c6793d6a0a0ef1b777b591
SSDEEP 12288:keZ1IysAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:dZupAhqJMZfVBMLeCT8qhKK
TLSH
T11F55124A26E820F9D6F7523D94F49585E3B278A2633193CF4219436F6FB2EC15D3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 4d3ae567dd459953f8b00b004c173d51dc3ebdeef6df8775f21afbdba78a819a
MD5 5e5617037fcd17b53eb59d5c307644af
SHA1 faaa3b3cfa0db20864c1ad46fc75c49cb16550b6
SHA512 cf27fe22e9547e90e421aec2126a9d4f36238ef7a4186e7629f35a870eeb976bcf37d445b975e297dbd47d184824d26b769d0d871feb71c087989386f96ff7ea
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8a8db9c1cdf7a5e3ecc209a7bb673abe9e6a70e67051ab6af9eac821b7419e1
MD5 96f85e90fcbd029bb85b4ead58699b98
SHA1 ed9836df37ff0c5176c25441eb8d6fccd3a16b43
SHA512 d360bb4dcfcd3146ec1e8a477631cda90f6fbb8d42b5258edcf33430328736996a0eab8eb201857950e2f9212ddbfc055f77e1e37aeb7172814289af7c2fafff
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:SQRQyi36YOcPbLvw2gAf+PN3dqCVDC
TLSH
T11C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b3ca4be2ea4cb06465da491796072a13c6856b288088b0cedceff66073f1a5ae
MD5 839aef25926b6513df42197105fb5a26
SHA1 e59be2f3fb5c1c5b0fe48c1da0eb175bd057e5fe
SHA512 d5c5dc8dfd7beff8f99e75109e1b50380834bd9e176c2afee946b242d455888921db8c9b802dc6347a5a6be69fb5ca150ad2b1762a276e418f4c90dfbe8960e5
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOcqydVmeCVg:6u6Jmdxd2d1qCVDC
TLSH
T19ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2972_13437332549129393.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2972_13437332549129393.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5196_13437332549069992.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5196_13437332549069992.pma
Size 696B
SHA256 b31d639c6bdc519e6b75ad09090d482d6595156277e9e3776915a7a2d29a9072
MD5 048692921f1bc4c9e964e99915ea820b
SHA1 29193ffd7afa7a7d89ca69f4103b57b0cbf5927b
SHA512 c0ecef20afb168d3298945861204957e0e6fdca33399003598ef789807b8c8de1142274d61ba07244cdafb9515a646eb3de7cd17a4d15d7185f275fe6a06d085
TLSH
T1C601C946A3144F67CC428D3584FE27512BB0FA501B821BBF7B50724F2E021C8AE99168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0083d164df751769bb5f082bf5edf73eeef9d33826b91283b199e13d0e86e0f2
MD5 b81028e4fdb51aef2c044caca6137613
SHA1 1939bd67367edca0171b192338f2c2db3ce528df
SHA512 d7cb1dabb5e270e2ccc47a6aed6f5de3d2bcb8f41363c42b4587bb7be3b866ef12b4f3beaea7f49e55cc67a486fc92c189f0fbc04a38a98e85a7860201042aab
SSDEEP 24576:3cP4mcvIjkGOxhKP2l71SNKbrh/8KBhAhqJMZfVBMLeCT8qhKK:MP4m4IpOO67N8KzcqydVmeCVg
TLSH
T1DE65BE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 0851a8679653d0ab202fc6981389a6597c0a18cde09a0c7510694d8bf1943376
MD5 3696904f5069d275f9864c8ba57e4db3
SHA1 cd3d4e9e024457d71c0298d561f8cc079c01b119
SHA512 10cddc9157a706d3bf1d23ce592268ab04fcb1cffd06600a7bd26b45141cc3621fbcac1681d29c272f699411b85b0d771feb1c09f4bafbd5f47c66d4d6965314
SSDEEP 96:6IamgyZBOhDc0mhK3sK3JNOkumxd1Vdx3xzcc9zRhK2HgK2hnd3V0xLoqHu2u2HH:4NUO0v0KahCjbThId9
TLSH
T101F1DD9A5E03847F3BC68B6B33832155AD5F1419E7D4E4723BEB6515F0CA9A4002F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 c78d2eac19ed3c8f6fab9a01b2b73084c37efe7c88bde925657db27e357410c6
MD5 84e3dc783716415e3055a88d0eed1a13
SHA1 b861a9299e4a7222cc3290b11931ec0f6552a225
SHA512 e9fe392887870ba1204ab021512fc59555b42c02af96101ef040ac2d0e8519f1568710acaf966cf45621089adacef8b2e276c7ff619896938b1acac6e6ffb15b
SSDEEP 96:6IamgyZBOhDc0mhK3sK3JNOkumxd1Vdx3xzcc9zRhK2HgK2hnd3V0xLoqHu2u2HH:4NUO0v0KahCjbThIdqCJ3
TLSH
T11B12BD9A5E03887F3BC18B6B33832155AD5F1419D7E4A47237DBA615F0CAA64002F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3484f67266ae9487988ae5e4e57b574ab6a8e45d83bd5a62c5579ab0ec5158fc
MD5 44bd7719c1815f19dadca23eaa895213
SHA1 63fb5cbb1ba6f0c45ab1a8601cd5cdbe2e26e575
SHA512 e58d3f9273edfc42ebd0ede2794fc5bf68ee451c9f65e864a74c38dd4f141069c86b278bfbd039fbfe21cc1e824723dc626f919cc9db116e797fd1a2633f394f
SSDEEP 12288:WbsfpAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:9pAhqJMZfVBMLeCT8qhKK
TLSH
T1BF55F10AC29802E8C16E6279C7559A81B3637C6593E1D3CB93C0F63E1FB56D09DFA643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d8069b59ba1cdc110cde92cdc89d02bd5f23941139d79e9234b63999b8afe6ef
MD5 6a6334d09d728c10bd68a9cb97982ddf
SHA1 f0d659e2a7c1287d00edaeb72438749e469f1890
SHA512 056656c470f3886a74d716bf81c288160bf3ac69376a27708f4da95384a73316cb4b9d2af34dba26cad840e42650a59aecb6ae282426b99d8431e86b75a96feb
MD5 SHA1 SHA512

Submit Download

41b7e94d-0fb8-49e2-84fe-d71e10f7f2b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\41b7e94d-0fb8-49e2-84fe-d71e10f7f2b3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6c07406e-7b07-492c-96cc-9e070772d953.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6c07406e-7b07-492c-96cc-9e070772d953.tmp
Size 414B
SHA256 8ac8a5a991e994f939379819cfcfb28d6fc4d5236bbb6b9f087144b640abc102
MD5 16db206ec1929307746ab508cfea4367
SHA1 1c2d7d0c457baf25719fc8b016f2ddbc2c3075ae
SHA512 601f53b6237e98f0ce98cd9fe5e85c9bbeee2eb8d928abe3ff0e437937c1d5fceed85cd3b44ad769249983c404d1ebe46f4b30d919e75cf0d39e6827fdb612f8
TLSH
T139E02BF6C965BC3729FD5B1D50504BCBE74913273640945B7A3C46098F74A360289C1C
MD5 SHA1 SHA512 TLSH

Submit Download

7192258f-a96b-47a6-911f-3ce62d5a86f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7192258f-a96b-47a6-911f-3ce62d5a86f2.tmp
Size 10KB
SHA256 4246f0cbb8ad3a9809d3c1d8cdb3fd8bb8dd42f9dd622b3c959b63931b2b049f
MD5 e9cd626714ef707cdb0ed5380f79d46f
SHA1 ccf53581f347006416bb5ee69b4559e8bed7f7ac
SHA512 b38698bfc3bfebd15bd05395e77483fcad5eeb47c67a23edf034b553e0922f137a269d81e582cc8e517b11c58312e916da4ccfa4b1e42412190a45c37a95b2ea
SSDEEP 192:mRANFWLUv7V9PRp2MXsb+WNn3w23qHl266Ikwn+iyIsnAUgR:mRAN6Q3X7XwA26Hl266IHHR
TLSH
T1A632C36AEE55793BACDBC229F9267687D7F4202130901E88E6FC893C14E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82daf404-a795-4c9d-b4cf-9940adec252d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82daf404-a795-4c9d-b4cf-9940adec252d.tmp
Size 11KB
SHA256 d3d479c1fa58ef12bc4e1b004506ff0aa40ddd596c074281c81a37ea1764ef48
MD5 30ab3d466ee0e7472945edd06426bcf2
SHA1 0b29c5219a6c8a690879860319dffe308aa3617e
SHA512 801ce9b1f0333760b7b0a7dbe8951dc8b2d61e797199b7efcc8ffe06b937c95760748acb2e7cf3a44b1a2ff759575500383386e2956d29411b6d3ca347f4cede
SSDEEP 192:mRANFWLUv7L9PRp2MXsb+WNn3w23qHl266Ikwn+iyIsnAUgtaJ:mRAN6QFX7XwA26Hl266IHH8
TLSH
T11D32C66EEE55793BACDBC219F9257697D7F5202130902E88E6FC892C15E76CC322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c22392f-a561-402d-a543-e6d5a7dfca06.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9c22392f-a561-402d-a543-e6d5a7dfca06.tmp
Size 12KB
SHA256 9a3ffc899c7a47dda95a5e512e148a36f4b54434012720f34e65e194de850735
MD5 3bc94d2dbf83b004c9a667a0d084425a
SHA1 05d928c03122e54111838605e26512371ffb56bd
SHA512 9dea58fcef72e5dad1f33fbbecb446af39aa58413699b603aa4458bee54e7cf23aeea72b7966f00e2bd4325408e98fdff60952d6e23b4ed8210983c1f9e07090
SSDEEP 192:mRANFWLUv7LXPRp0MXsb+WNn3w2XqHl266Ikw1+iyIsnAUgraJ:mRAN6QfX9XwA2aHl266IVHe
TLSH
T1A342A46EEE55793BACDBD219F9257B97D7F4202120902E88E6FC892C15E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63a9dc4e-47c8-414f-becf-29543221a36f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\63a9dc4e-47c8-414f-becf-29543221a36f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f8537cf4-98ec-46e9-ba3f-c115dfb7e9cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f8537cf4-98ec-46e9-ba3f-c115dfb7e9cd.tmp
Size 2KB
SHA256 c0ebbfd203d5712542abe0de88af5f353e8052a3fb4bcdc10d0cc6bc857ad57a
MD5 2655295fe570787e848ff5840f5d035f
SHA1 e782eb0ee1a55c98140fe35ef030bb81b1927776
SHA512 9ed317d3850d7346f23077b99e79da3ca174e4666b30ad01fe8671bcd3a8af5533a96a92b56f3629ac2188cd5067e4a16e5ed559488be654996872cd9e226ce0
TLSH
T1EA51DEF7D7E48A6DC51196F49B20BE1FCE2D0A14131C3C66C8D8AE5B93E2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 3KB
SHA256 143a36664bf6594a49561e7a4c395fb7e1657b8cfa6c82c991af281206b465b6
MD5 b8718b22ba230688eb0191012ee26e13
SHA1 c26fad5b2641deb306acd7773c3f17894629444f
SHA512 cc848a8f7c1be52d0c1ac5b94c14567990167ea1de10c4d815c857111b6cf9d5d061b0c7bdfce006780f4c064e9a7c38d83c2c914fa9c9a3f5a8177dc7af54fa
TLSH
T10761502CD4780DEB1DF27236787D0782FA51936B008118063A7E899D1FB39B38481FAA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 c373089a2b0997839abb635a627abd67dd36617b738a8bd8c92423d172df15f4
MD5 652fb1aca6b7df07c306f5a00a626078
SHA1 04f18a6eccbf199c0b92bb3735ef9d7088b8a399
SHA512 ad6a819951a6a9c73eb588b9671fd2bc777fbc324893ac971704338a6ea461144e1d6ea5a559c69ef35be68932df8f60263b480912fe0a894ff08d04390e72ed
TLSH
T167B01245C0422301D00503B211A098543670CF34D11213C593F01DB2C8311608027108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 aa9cb25d8f2e3fd1c6fbedcce22b1b68c7f7599019044a378bb9a1366ebdeb87
MD5 c8656903b6140c39328680dbdc2989e9
SHA1 9d62f7f7e833fc6f300d33cfaadf1bc4e207664f
SHA512 d0b26822fef100e03fb3538ffdd912d118d574d5fd927ee924ca06bc71497c16eb0f7d89673050a87b1bc68fd9cebe0d9d5221aa2fea91e014df5440eba3be8b
TLSH
T128B02288C0032A02C00303B0B8C0C8E83020EF22C2030222A2FA0A33CC30320022C020
MD5 SHA1 SHA512 TLSH

Submit Download

a0dc6c30-3bc6-4f45-87f0-5cf1f818a909.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0dc6c30-3bc6-4f45-87f0-5cf1f818a909.tmp
Size 12KB
SHA256 2e8f4ad0ea4f546e820ed933963243c5afd56ca5264dde37fb9a4419ed239065
MD5 872c7b019973940e0b076fef6930ed50
SHA1 a2847094d68f9a2ee9fd0686ae7f62c0ce5923f4
SHA512 55e5de914d25e102eb282ae4bbcafba4678f79b4e775617f24beb52c559583c3c25431d66001ba8f1b31c88f85468d0055795022336ccee56ad31955cbfa022d
SSDEEP 192:mRAN8WLUv7LXPRp0MXsb+WNn3w2XqHl266Ikw1+iyIsnAUgraJ:mRANHQfX9XwA2aHl266IVHe
TLSH
T1B142A56EEE55793BACDBD219F9257B97D7F4202120902E88E6FC892C15E76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac4fc9cd-2872-40a6-b2d6-c118fce816df.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac4fc9cd-2872-40a6-b2d6-c118fce816df.tmp
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4c79e4d-5c0b-4edf-8e18-ced0f63d0985.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4c79e4d-5c0b-4edf-8e18-ced0f63d0985.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a30ca505-8df4-4c4a-8d49-fa84bb556663.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a30ca505-8df4-4c4a-8d49-fa84bb556663.tmp
Size 269KB
SHA256 99d8605d29f3162b88a6c0c5c003e7d8d062b35834ca722b248312af5e1f6c12
MD5 cd44ea4a9117d11610154c58dcf8e880
SHA1 060a1d960123f512b7dd5091f860cf5a77da6a83
SHA512 af1b96d83003a66d7f0bcd2f3feccf5de935d600ee3135d81d4cb6c7ceb9c5cd2e78b8ed2ef6f5f2f4a981583c60f5db23f8da6d2142d464e6ba3e49da5064d9
SSDEEP 6144:BpHCsUfw5u7eC94LUX4rY7Q/C3+hFD+7t56OD9ZfSApprm:qs2w5Ee5Hra3yFSXD9ZfS4w
TLSH
T1D44423F1DF6B286B1EFC4607711773084F79DDE5998C2549808A6F8B209EB8A0663737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a59f8df0-f292-4864-83f3-1cdeccd9142c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a59f8df0-f292-4864-83f3-1cdeccd9142c.tmp
Size 270KB
SHA256 0e3b9a87ebfef19fe1883123f21e451cbf2f37830fc7bbef5a6e317fb26abab1
MD5 da1564496fd49545262551ca7ea9e4ab
SHA1 a0a6483e2da756f8a8a397703085e7f46d69bb1e
SHA512 e7f13b1b55a741bbb2c064c2ae7ae09b07a6a3464c229a9ff05351711c6798875fd8acd1eeb27e9a5166fd83d8da0815333e57c6159c8ad8ec5ace41cc635b5d
SSDEEP 6144:B+HCsUfw5u7eC94LUX4rY7Q/C3+hFD+7t56OD9ZfSApprm:js2w5Ee5Hra3yFSXD9ZfS4w
TLSH
T1C74423F1EB6B186B1EFC4607B11773084F79E9E7988C294D804A6E47309EB894777623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf7f1b16-a801-46bb-a2ce-384552d0e65a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cf7f1b16-a801-46bb-a2ce-384552d0e65a.tmp
Size 130KB
SHA256 1104ec5427aa11e22d9fbb8443e0ae6d48b47dfec4df1d301ef5b30ea03dac6f
MD5 2709f5cb08d13e52c6b5c1aaec1a2c45
SHA1 5e8731b6c195a90c99a73f9d7503232c8848ee1b
SHA512 6a6e29b0259b79fd8e0f6030f655ec5b7681544e38b445c0a0e225bc36398c6c695f98540737f7a12ba3f180d0622f1c39dc50024118e1f56d714f4e60f0dba3
SSDEEP 3072:UZ+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UZ+hFD+7t56OD9ZfSApprB
TLSH
T158D31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eba7fab0-2478-42ed-99ce-40f0436989ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eba7fab0-2478-42ed-99ce-40f0436989ce.tmp
Size 131KB
SHA256 b517fb0c21c753ad1775be69fc04ecd43c4f4bf69896777655f492aba3fef3ea
MD5 3366224eccd06c217f46be5101954a66
SHA1 a8815aa74f9b700dd443f0564d1913c9d75456a7
SHA512 98de5f123db93b16bde13cc27d29a68c5fbb4cc956316fa43f031e8cad0fefb31e2f15820e1aa2ea6c2b355b5f79406c827b0a196e5308e535e6ad6f2ab85451
SSDEEP 3072:SH+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g0:SH+hFD+7t56OD9ZfSAppr0
TLSH
T181D31232AA95D8B7C9FC6141A147A300CE766CEE45DE3A09444A5F8ED09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54a0602a227ba850.bin

Path C:\Users\Admin\AppData\Roaming\54a0602a227ba850.bin
Size 12KB
SHA256 a6ba911aadf53698323b2af1a93f76bdf8d4fed8fd2b5616264e742c503527cd
MD5 6b0a7449cb69fd3e35313f62fe09193b
SHA1 6a76723817a8a592bfa047fe92d926c8db6d918e
SHA512 be0692b6d3ad601352a9d14fd770841f8aca24a334e615dbc95fb895a3392e01a8f3008e7c97f95d0226d0b1f03d99cd2556f1c262e09557202ca12b4f3ba2ce
SSDEEP 192:AkdBG1r7zHjtMomhOiCpphE6SgcnYMZaoVaDnnWUJiV+cB2IKed0QyDNd8NC:ZdBEbpg6JqhZalDWIiVKIFd0ANC
TLSH
T1C542C0FC9D702B6C75E20091981AED75F600D85BE9DD3B12D44622B033C16E86AE9BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 1fbbc70c4afe7a3a9d9805f3492e1832a4b85608161140277cdb455670d246eb
MD5 2cb58279102f31f261b27f640fa2cd8f
SHA1 b624fa5f59c4401abaf042dddf6bc3d4858b95e9
SHA512 130dd6761b25b08072cafd30346935b3c230e10860d3ed47e80aea77be701d2a6da46ecb849f4250491b9c6fd8e7af237238d659f0f8bfa6b8eff5b2ce8da781
TLSH
T1BE41890137F92B59F6F38E326A323B200F7BF817E9658B1D508552980CA6A14498CF7B
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6215c70b3d4c417b7850ad9c58b9a50238a9b29360c3a3183793e540422c99cc
MD5 e60810bc3214041da6f1fc8b9330bbca
SHA1 5b98eba4c73abf06a61103a13dc051ae1e63b213
SHA512 935acd9e61229202095006f7cd7fccbf2b997a5b6812519eb4902212edcaef6bd399dc78d0702745eaaf6ca3fe8dedbf7bc45634c5f8907385e0922fe148f079
SSDEEP 12288:zJAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:zJAhqJMZfVBMLeCT8qhKK
TLSH
T19B45235309FE4A5ADBFA3A7130B4E4A4725A7AF0E710E287D209572FA8F4DD49D33111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9d2d8d66456cee5e317f96e21fce45c2cc84929a67d9228b291da132a5fdf597
MD5 156a2c6489638ce68b823079250db589
SHA1 0b9c073e381a2f2a99b18d415c0b12c4204ddeae
SHA512 4e6f6a640d2904c3e69decc287213d081c717766c4aa56baca1b1d3d4a39cc6bd71ce6465b65597b13c700a582cf50b98572424f4adf3ce63d75aaedecd6ee4b
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQPcqydVmeCVg:Xa0hNYG4JwfqCVDC
TLSH
T16A85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 837a2c1d7fd31521614875b0bd716fdc648144de529e3f6267ca6fbb8c3cb73c
MD5 79abcabbca7afe88eebaed6b16cb7fb2
SHA1 9c58c9fad66a770fea1e40c61df1d596a0d093a1
SHA512 ce4fc6d0c845f93d17c389b3182c4009b4524df7e6b5609b59223beb2a2b6c46f850277b6abf46fbd925bec45f23fb3ad0af68f7974696841cb8f65c5971cf1d
SSDEEP 12288:OhbHjfXIAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:OhbHjPIAhqJMZfVBMLeCT8qhKK
TLSH
T14555127E06FD10D9E6B2A27D91A5C546E371B8612321A3CF5386823E4F77EE45C36B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 09fcc1b595804af87a7a4b35109eb6dcf30e9f4df3189d78c5744d061ad4e06a
MD5 6591e0aa1e555f2f796f33b9a57f0a12
SHA1 2650d1223cb4fa57d448d4fa4a04ab18281fde5d
SHA512 3bbea60fba93177e50f6728f6f4701d5498adcdfd94517ba4ec9de34c83ae43e953372192869c122f13b0461175b0cdba432f1033551af3c00bc58d141f69bd2
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/wAhqJMZfVBMLeCT8qhKK:ZIgnaTk46ppR/wcqydVmeCVg
TLSH
T1B945B02EF2B910B9C8AAD236450147B5FB71782D1F2096CB0174C638AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d5d53668aaf07000d449af7d68d460d7536262a6dcdb5d02f7c227cd266c90ef
MD5 f08bbbc845b4acd80d8a3bc470f7e9fe
SHA1 e97889f9b6d41bf2949ed2ebc2253a34db69000c
SHA512 26e72644a995faa0b55536e42241fd1155246ca47f2f63cded98baba04e57f82dffb4ee07e79b7f7dd1d214681015c444f64556ca90645964e79e6344bb4e566
SSDEEP 12288:U9AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:U9AhqJMZfVBMLeCT8qhKK
TLSH
T12E45234608EA0D99CBB93A7630B5E4D5B2957AF0B321A3C3D10E572FADF4DD9A933140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e054a2d460f57a66a7f268ccd8eaf681c783bee2ece4111c29f027f82d501b7d
MD5 e7ca28322bb964c5f64d8e68d45db1f3
SHA1 87d2c48d1943aef057a0a220f8b50f04d673c399
SHA512 979fe297acabd942446b94e506c5e6969276864983134b70fa4fd6c6c73b4e220236da8f74f201e18b5ac1199dae5e672615c9bc0af9eb96bf81dc51f875d0ae
SSDEEP 12288:uObfA4LWOsvAYFT+AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:XbL3UT+AhqJMZfVBMLeCT8qhKK
TLSH
T128750155E7A500F9E97B913CC5B29916E2B2B89D0360E7CF03684B6A1F637E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 3084bea5104dc2fd6b1af279e182baab1eeb55a8bc69511353e701ef3f6ffdc4
MD5 d2943f1ffbe7d59dc675ee3a1b79dfd2
SHA1 ae365f60290fb671b7ecf951ea9d1dba73d5f797
SHA512 c27d087f34296376bf7d5440abed7769f88c93b8ef87e774652340735d3c963a557d5bed1957e24e75ed92667fc6057cb956056e97429248f6bd62f4fd83646e
SSDEEP 12288:vpFtIOyAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:SOyAhqJMZfVBMLeCT8qhKK
TLSH
T1F355121A36ED10E5D57AA13D9592924DE3B1B8B1132153CF4290827F5FB3FF86C3AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9d4be56be6adbbdbf7ad8f0b096ab749aa5adc6913485c59cb18705ffff259e4
MD5 767bcb54c49e511233269706f0bcc70f
SHA1 858ffcbf0ff0ddeab8f2da07d97d0492ae0aa9ab
SHA512 442aa5a4af0ad6fa784e0a942327e62bc0fe11eeffe9da52aff68746de884fc8be62423afe3ed8062f9b4ef669070f9921981223a8e1e8c22cba46b46f4f1d5e
SSDEEP 24576:P7NM9YmZqmWMUkPjZM48Mv6bEhsZAhqJMZfVBMLeCT8qhKK:P7cBWMpPjN8DbEhocqydVmeCVg
TLSH
T11765AE2E6BEC81E5D577D13DC9A28205F2F2B4611B318ACB5152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5f7d553a00238cef129049d4b5a45468c3fd4fae8e6afc573ceb071b43ff34f3
MD5 8186deb7718010b34b5bd4a54b44913e
SHA1 1690ce1c64cac9f10058f80259a51697af53084e
SHA512 06747cf0c030b6148b762f86122e99021dac8ac815dbb3eb41cef4e8168ad808fe80d7df225f2728b19c86ebab60473e9c947978f91dbd93b954c49dc024b65b
SSDEEP 24576:kW6BApg2YuyuNDYTabvcRvNYf8km1rAhqJMZfVBMLeCT8qhKK:kF2YuHNETovcvNYf8km5cqydVmeCVg
TLSH
T159858E2A27ED80A4E0BBD27D45B6D186FAB2B8511B3056CF4255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e02bc81afb505197175b8e648b296f8d3bb1c24748b2603f06097b3ac3f13b11
MD5 32e44d06f386762708115ba605ca5bb7
SHA1 6e05af730ce177593a2802a1b72817b9aa46ad53
SHA512 29eb0fa32ef244aef518a4807fee268968623ba0b5b51bb2a5b2a75698fe52f84228728dc2a2b8c0ea35b797192a510f5f041c9c95ac5ca9fa930de197a7556d
SSDEEP 24576:TAFs06+OmlfkNXEbToWAhqJMZfVBMLeCT8qhKK:cFs060lwXuvcqydVmeCVg
TLSH
T10965AF2F66EC00D5D07ED17E8997C91AF2B1746307215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 04084ee94a7c656263c1f2aae36d6ff5a1c2705a3ed7b72b02d784846d892fb2
MD5 cc5e5d6cdacee92556d3bb68a90f259d
SHA1 0a745ecfc50de71d04f9bb592392569fc87b96e9
SHA512 7dd5670e5d97e447e2cb5d1cf30dc96eb8fa7e7498ec2d595f2dd8e3d5d1f90a8a7b1dfeb33fdb59c719d28016a83976ebf57a1039985b7b2cd150975f3343f5
SSDEEP 12288:BCJnJ5D3Vkrlzx5AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:YJnJ5D3WtvAhqJMZfVBMLeCT8qhKK
TLSH
T13475E02DD2A810F8D4B7C274819A6796FF72387D2B226AC72474D5353F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 33132b44f8ce9e3b10ac0c2c7e3d0300f21c5754f91dbea4d7d5fc1131804fd1
MD5 8d7724b5983787dcd6eee9b4ea578a66
SHA1 527aec78d8aa3aa03480bbb6da2e0b9f9f944c6e
SHA512 b7d3d0853caad96e08c3c0741065e0f645556ac0f94bb1a65a52ac074a96e282ffb0f710b988fed4c3261215a91eb9f1eb2c05dd22c73b7bb3d20416ff56f455
SSDEEP 24576:pEPohm6/7IIXdwcXrif7qQncjlP65i3VuwAhqJMZfVBMLeCT8qhKK:Oo06DIKdwc+eQnSt65aV1cqydVmeCVg
TLSH
T10C956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 126296ff58a71a0a763813aeae4962a7deae1091f0834fcbfa21cd7525c17de6
MD5 611b1bafd2f6780404cfd2c51186aea3
SHA1 0955d0bf2a79dda11540c48cf4e2327dca86bde8
SHA512 f813096d9cc1bd6461f367d86e2e420cf47570564c2a24d35b1f97a4ca60cc1b17d207e15a7ec3ff2a0f677b49d2200a8a8ae3d0827d1debcbbbd0be4b0aaa14
SSDEEP 12288:kEP3Rr4AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:fr4AhqJMZfVBMLeCT8qhKK
TLSH
T1CE55126E1BED60E9C57AA13D91A0C545E3B2F0B0671263CF4295C33E4EB7DE92D39A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9244a1b8c216cf0b344c2bfd3255a750280bd7a0e99cf32590fa2867f4b632a5
MD5 b008e28a4f3ad4885e9f9cbba1bac543
SHA1 c7550ef71a778b4794dbdbe227192f65fcef2ec1
SHA512 e1a216c9604f3aaf827f89ea4afa28a0fae11601ab9da54c9b7dab5a7f33f81cb2eff3b8fd02ceed6836836808f7516b9a98df387168b977443112026e0827e0
SSDEEP 12288:Mjky4AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:MIy4AhqJMZfVBMLeCT8qhKK
TLSH
T13555130513E854D8DABA1638A5B2D1D09775BC70AB20A3CF9180E73F6EB6FD4AD31B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 eeba1b3c11fe3c543df524164f96298dc370258e7b8fc7d24c7e4136119ef24f
MD5 e77b17b949248f622e3c95a04ac32fe9
SHA1 227d96d22cc56cba1c50bfea584445979a8129f9
SHA512 e7867a95db5af58061674fb8163e3b5e1382f34becb6859a6bddc7535e1648add0fe644c2dad7ed117e70840c53299149658e39ec19e401b0eca4f360999abbd
SSDEEP 12288:HFiAhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:liAhqJMZfVBMLeCT8qhKK
TLSH
T1FB45235A05FA19A9CFB626792174E8D0A2A179F0B310B2CBC149D73FDEF4DD46933580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 13d126bc9d259cb2ef6696010c28c120fea474dfd68abd34e4b380077ee74434
MD5 d18424adf020999d208b397728eb87f5
SHA1 9d1515f9bb63b428e7bcdebe2bd48d323196f8b6
SHA512 88b9ab09244b18e5004a2f6ec13a45e7e0b7eb2e273478c26ef822d63ca77e1dc5e46b1d58beb6caa27d2df0d8dd0ea1b9ef8db0aaeb2e196c533078eba23b14
SSDEEP 24576:2Q9MxZKdcz97w3xAhqJMZfVBMLeCT8qhKK:2VKXxcqydVmeCVg
TLSH
T15C558D2DABF9059AE177D27594A250C3A673B4301B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7e21c0053ee37207c8dbc4181fc71c284a3bc49dd2d7e8b293b52b47684e6d31
MD5 d3782f5aba75783ba9d0113dd63b9c8d
SHA1 2aec44da4e5a0b0e7c170c6011ee49859efd0fdb
SHA512 8a7531564c1ab3c53207fe8cf97180a8da3b884dbfd1726e077ccd129574f802bd514fe38864e8e10c857a70964efaef5f95d5e5d55090e9cbcf37df4c09ccd5
SSDEEP 12288:LyoKo2HRple9p8AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:LyocxAp8AhqJMZfVBMLeCT8qhKK
TLSH
T1FE65E01F7BAE40E2D176913C89858645E3B3B0705B6263CB9291C33E8E779E8BD35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ebd4572a38814eba74be6c908657c1a600a4495512d129d5d3f9ca8288523d79
MD5 9fe00e24bc702a3b2c15ec4878c472ac
SHA1 7e841fdf3751adb6c82d60c0a55d0bbbe63c8d79
SHA512 bf52e81122434392ea115285f02387972cca9267ad0045f8a7d4d21838d59e8f48736f158e25a55a1805774f1d8020d432acef277cb53ade034ec27e7e434de8
SSDEEP 49152:+WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK8cqydVmeCVg:Y0zuNIbqCVDC
TLSH
T1A9A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9f07f6a81559f6bdbaf249b5426481b97cce206cb02c800900fa57bca8c4a232
MD5 de8bbc3fb32dbed3204824a4a4d23d1b
SHA1 1110801faaac1295413e5fccfe3341c00b900623
SHA512 59f5d680511e54a654dc8c2a20ca9a85a86f32f03e6928367d1d6ce1fa28cf710900139858c7631de3436491f93fa374b4d7712a8e3da46cd26390e31665aab8
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYujMqb4AhqJMZfVBMLeCT8qhKK:lTDxR+N5YzT4jMFcqydVmeCVg
TLSH
T13155B02EA7F905E9D1BE85799A23C512FB727821033193CB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2421a1891934f5614923ffa5e6a8d213484bb71d709102d5c8afce3d0a8cc8c3
MD5 0f08afd61d2dcbcbda16453e19c0231b
SHA1 014ec9eb68ec7b65512400b615ef84281c7ec98a
SHA512 1ebdc3156a4ed535066638564ff9acbd6b9ad4f8988529340a7d23c9298f9fda8dccf9c73963f26d6c6d1215e61bdc9e96742d6c7c7f83b6e7bd0f9ce9441c5e
SSDEEP 24576:HTMdOz0FFS+bmSLnAhqJMZfVBMLeCT8qhKK:10K+bmSLncqydVmeCVg
TLSH
T14F75F13E63AD14E5E57BC27D9653C906F67234610321A6CB0690C17E3FABEE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 13afb6f5313c0d2e5ad0fd45e0802f3389ec8e4e0d5e1112adfa02bd9c41bd83
MD5 5c38202655caf09142e85a92530eb49f
SHA1 01fead072d0d6d9edd4613053597bf8131648906
SHA512 17d7ff77657be4c984a948ed27468a72a221e53488e47527cbcbc865d60264e87c0c2d0cd3dc356b337c261ecc0d3ac66a817f16432beace08b3d78cd07dbf2c
SSDEEP 12288:E47+AhqiaFGvfZo8FDMwYbuscValH5glMO8N23CTepqhgAeTW4:D+AhqJMZfVBMLeCT8qhKK
TLSH
T1EA55220D17FC24D8E9B6623996769195D370B8B12320A3EF61D4C63F8FB2ED49936701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-78-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1548-135-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1548-72-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1548-124-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1548-71-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1720-141-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1720-146-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1720-262-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1720-139-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1896-101-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1896-93-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1896-99-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1896-104-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1896-106-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2388-186-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2388-478-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2388-189-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2444-210-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2444-513-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2444-213-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2836-664-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-659-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-663-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-662-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-660-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-656-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-661-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-658-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2836-657-0x0000028F36150000-0x0000028F36160000-memory.dmp

Download

memory/2924-594-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/2924-585-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2924-648-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2924-589-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/2972-615-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2972-546-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2972-565-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2972-552-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3300-274-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3300-153-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3460-165-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3460-156-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3460-162-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3520-482-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3520-168-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3520-174-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3520-299-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3520-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3520-486-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3760-50-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3760-49-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3760-42-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3760-188-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3792-121-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3792-119-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3792-235-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3792-113-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3812-200-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3812-198-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3812-497-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4032-260-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4032-263-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4032-580-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4128-275-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4128-584-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4128-266-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/4128-272-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/4208-617-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4208-296-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4208-309-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4208-349-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4208-325-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4208-300-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4208-654-0x000000000D730000-0x000000000D738000-memory.dmp

Download

memory/4208-290-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4364-212-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-91-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-88-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4364-82-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4672-587-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4672-286-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4672-284-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4672-278-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4912-16-0x0000000140000000-0x00000001408BA000-memory.dmp

Download

memory/4912-48-0x0000000140000000-0x00000001408BA000-memory.dmp

Download

memory/4912-0-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4912-6-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5024-224-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5024-538-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5024-222-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5024-216-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5152-17-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5152-20-0x0000000140000000-0x00000001408BA000-memory.dmp

Download

memory/5152-10-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/5152-164-0x0000000140000000-0x00000001408BA000-memory.dmp

Download

memory/5164-22-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5164-28-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5164-39-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5196-608-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5196-582-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5196-577-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5236-248-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/5236-566-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5236-242-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/5236-251-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5260-227-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5260-233-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5260-236-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5260-238-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5260-240-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5268-647-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5268-568-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5268-557-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5268-563-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5376-136-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5376-133-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5376-127-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5376-250-0x0000000140000000-0x000000014020E000-memory.dmp

Download