baf84c60b194a34f5c769be7639db957f411120bc1400963b0dbbf327fc36d6d

Resubmissions

27/12/2025, 16:30

251227-tz9k8atkhp

14/11/2025, 18:24

12/04/2025, 14:57

12/04/2025, 14:56

12/04/2025, 14:53

Analysis

max time kernel
1799s
max time network
1494s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2025, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
guns.lol-view-bot-main/main.py
Size 2KB
Sample250412-r9mhbswrv8
SHA256 771d48507ed0d32392b42e004e5acb30681e34b7d9fe718b5cd130233ef2c0d7
MD5 8d03afac810e8e3bcc38ed37dfa2ff18
SHA1 6c46618964314a7f8bdd485223fd5501d3b3d6a0
SHA512 ea0bc9c52515a8055d5e39043a99d206c4a129a2ee6b85e93866cdc4d3d86f986eb0d5f2d166e77ebe4234008a58a91d55da7b64263897d23e6c69d0986a4d7a
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
198	3476	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7043fbcbbaabdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea196d5ee54e6b4aa3281a697d51ad010000000002000000000010660000000100002000000099568363aac2a8c6c0203eb3d44fa1905e213813e165fa73c4a2a86a41d4a645000000000e8000000002000020000000e993d1a44f614e93f5d57dcef11631863ffb1b6e216a125cc19f86d8055d21a1200000006745860a74de3fc1f5e3a4a5f2716794c92ef40a9ca024e835ef59d70ce322b24000000007d27266c6bbfe5edf17e46f0d8a99711b7f812b06012366a4b09187f9819924fcf0fcb970bd53997758b293f22f0f6d82eee7527236ed4174795072840e0c4f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05d01ccbaabdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F7069B89-17AD-11F0-B8F9-5E1246A3766D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea196d5ee54e6b4aa3281a697d51ad0100000000020000000000106600000001000020000000b6d8ae19201d12803697fdfa44200a86245a03db519c2648392580acccddf512000000000e80000000020000200000007d7af3057d5544d8cf0aa7ca98709c653d7a454e679831159f1266dd829bbe1020000000290a3b9291f0db4892029f7d5510a948de961266e4cb1dd7014a9370e832eccd40000000b86f2fbe44abe5ed7e5f4a5d5b58ca41875810290683e8011002c735998a468b0386cf2e1a7551a2721118fc854a3280971a2964e2b8b02889aa02b3c98329c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133889432654466335"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
224	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe
Token: SeShutdownPrivilege	5048	chrome.exe
Token: SeCreatePagefilePrivilege	5048	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4952	iexplore.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe
5048	chrome.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
4952	iexplore.exe
4952	iexplore.exe
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4952	224	OpenWith.exe	90
PID 224 wrote to memory of 4952	224	OpenWith.exe	90
PID 4952 wrote to memory of 4572	4952	iexplore.exe	93
PID 4952 wrote to memory of 4572	4952	iexplore.exe	93
PID 4952 wrote to memory of 4572	4952	iexplore.exe	93
PID 5048 wrote to memory of 5044	5048	chrome.exe	95
PID 5048 wrote to memory of 5044	5048	chrome.exe	95
PID 5048 wrote to memory of 3476	5048	chrome.exe	97
PID 5048 wrote to memory of 3476	5048	chrome.exe	97
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 1176	5048	chrome.exe	98
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99
PID 5048 wrote to memory of 5452	5048	chrome.exe	99

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\guns.lol-view-bot-main\main.py
1⤵
- Modifies registry class
PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\guns.lol-view-bot-main\main.py
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4952 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffc378dcf8,0x7fffc378dd04,0x7fffc378dd10
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4688,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5428,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5436,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5460,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4172,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3356,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=240,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4932,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3456,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6060,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5716,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4372,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3300,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3292,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6648,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1132,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5636,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1536 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4612,i,6742316418138344569,4058773771291652943,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:4040

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bccda7fa356f1d86145e3a64e4c1f4e8b97e9881959b24566d5cb921294381c6
MD5 6898183ffcf284bf8afa82d8dece05e6
SHA1 ede202fb361c20a24a9cb513de467592691e7908
SHA512 c7b06c8a8d9586030f676455ca7ade8a7c6d235e196306db419f76d45d8f0032f4ffbc9670aaf501b9f523452ee466a1138430979c26a929d110c2a4452014f7
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 216KB
SHA256 e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b
MD5 50a7159ff34dea151d624f07e6cb1664
SHA1 e13fe30db96dcee328efda5cc78757b6e5b9339c
SHA512 a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250
SSDEEP 6144:iprd1ItBjbmy74npup6EFUdzziBu9u60ZNgxNrk1mP:iprd1ItknfEqzio9u60Z421mP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1f95e8cb846235c2335319db5a54e006b38f5f278ada1dd03615305ced679508
MD5 a7f15e10560ac3de8febac1c898394d5
SHA1 ec26748b06ca4397724896c617d74054c56a9275
SHA512 79fd8fc62526b55aa8c45e8c5b26ea27b9b89048ab80ad8a9565e0bfdbfd5ef5573ed302cfa77519b284cfa3c26409534004f4137a080c702334571d4b008092
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cbc3fe9670ba52277ec9f35b3225c45dd704d0a4d438eb48f11308a4cc285749
MD5 72d4432e60bb650eeafbb0d596d15fbd
SHA1 ed67bd0d1ca2d517a25f2a3c87d67f6fd3cd522f
SHA512 bac7d67fecb9305fcbd86501bb25cc551ac48b6ec317b7f76f861328cc05fc59768968d121d0e92c708015895dc6f29ca5ff01127dfe68b734d3b03962ad30a7
SSDEEP 192:CupLhImamSm0mJm3mKmZwbtz3Q0y7Xnr+pxk3WfN+H/G:CupLhImamSm0mJm3mKmZwbtz3Q0y7XnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5c2e47eed6b8fece25df1e8a7dc9a32c0b7cbf8b626c3a788e99440673b53731
MD5 c659a85834468a9c1fd831b042147fd4
SHA1 69bc5d02052382a4915475ad496a4a646fdb5e6e
SHA512 1c7b37cb2f98efa4f6972ebb04d7ffd628dde23f11f727b5b5573a3a46853955f0d563e400ac38cb35c7818f0cc9d20c518f5dd8eaee0bb24bf4b35889a8550c
SSDEEP 192:CupLhImnm0mJm3mKmKjNXnrx7/YN+8/3mnhdH2sx05Zc/Kxi6KP:CupLhImnm0mJm3mKmKjNXnrx7/YN+8/+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 98f1395d567da8162308b850c9da50f195e20366c2d05a4d466f4ebddc5241c0
MD5 9865c73cbf8870b491f9e2eb74867fa8
SHA1 be99d04618de8e41c867e118c31ed00104be3a43
SHA512 63b257f675b3acf6fe0b3041008527e9eb6c2828e151f0b6c96d301ea96e8515f072d80209dc727824dc36e5c1634a14bd92fafefd0ab50fdda50097b9d67cf6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1e2535df19e5d56a483eaba4201a07c7d6a76d3317f1e258381a700e70044076
MD5 3e286171ac01261302c252c30c7ec727
SHA1 e628c6d27727c70b6b18fe504b30abfa287a0a30
SHA512 8685ec6a9e00b5bbf554afa3e9f4b09fa6e02ce7b30ac682c78c8dc4a3cd7e45eebdf421df031ecb08d736ba2a1103e4eeb2fb6f1c5c4b46d19674f317a9e1b9
SSDEEP 192:dTYpcBzttsiDZ8PRp/HHS+WN4yD8gE/0AdelpQyIsnA/g2:NYpmzt1wX/ncYjs/Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 09c8741fb253cefd4b434989c18b8feb5c0099e74f88e3c7759283397f897ca3
MD5 36ca9d196d651d2c93ba45f832dda066
SHA1 5570d8fa8f2c47bfcf45cf65cfd3c82b064a94c4
SHA512 c6ef368f59e5b14da70e0b7c3ecc8d32c92b908e1540e1eafe213a12fd1a50d2babc6dfdef3d4cf2a29e2dd03bb81f2f689446fc4b79d3e505999053b94f4c62
SSDEEP 192:dTYpcBzKtsnVDZ8PRpAHHS+WNKyD88UskdeBpQyIsnA/g2:NYpmzKqwXAnceLsfZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c7556fd283c66430c106969677dc515980f4de123da34b480be57740c075c7c1
MD5 d73e855aaf42635310d9c5cc370999f5
SHA1 a425ef64f0ab94bd5c29815cc2bb87aa61ad6fff
SHA512 02c7a2c79c881aefe8c51ff79ba5ff56c3bddfcfdce0ead5a258e9e4134cc52aafe122810028afc28f623431283c0d96830466c47be0d5b275675c1868ae1d4f
SSDEEP 192:dTYpcBz6tsiDZ8PRp/HHS+WN4yD8gE/0AdelpQyIsnA/g2:NYpmz61wX/ncYjs/Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 751c23001f2f6f0428a024dd619c363a28ceab3cf51ced8f42bdabbdb0522191
MD5 a48a63833a80a8b88cac16420d45150f
SHA1 66176cdbf18371425d1fd5a205f75cd682135829
SHA512 06ba0007ff45278973a17ca256235fb603256cfa21bece49841b94f1b7617477926ee99ce22e26c0603793886aaaa92a3118ddc56f531e9e65c3c9605450d3c9
SSDEEP 192:dTY1KtsH0VDZ8PRpkBHHS+WNGyD8VADKmVIde/pQyIsnA/g4:NY1KFwXEncSnmnZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4a813156164eb1b930f6ca71e11692b06a88a9735f0a412d34e5eee17a145db4
MD5 835e9376db9229e53bf7dc462cb1de09
SHA1 19acde817f70e13cde182f710748987c6f694027
SHA512 36242719bf1921a49f3b18ad923f3fed8c5ccc3f7bd50d0cf67f8f23a1281f2559fa46b8895729a0d8b30930ccad92a286034a27decc24ec841c234374472785
SSDEEP 192:dTYpcBz6tssDZ8PRpAHHS+WNKyD88UskdeBpQyIsnA/g2:NYpmz6bwXAnceLsfZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 06afb9663097a2efdf068c77ca154affbb9cc610811e4ec383860703a877e876
MD5 0df27e6d05a8304992641e03ba3f707d
SHA1 cde6a2c8baa60f9933ef98e129cfa90e9f6c2a2d
SHA512 5a871e73f23b7f70e4451a265621aaa76a100f5a06c5c448cccaaf5ce00f19a682a473ce7978d2acd21c16d0484a5353f8a70ce88bb904d44a31785d7a9c14be
SSDEEP 192:dTY1KtskDZ8PRpkBHHS+WNGyD8VLDl+VOde/pQyIsnA/g4:NY1KXwXEncSn+JZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 0368a39acf345db9ffe1ba8f6e3bc118b00c98142f2874ab8a2fa8ea61ac193d
MD5 d6a12b9992bbf6cbf6abe2defef78a67
SHA1 3d730e354989d706e7ca7a49adede16395052f88
SHA512 1c2b7b49ddb4b7df2580e68017582ecb086ce4e3ca314ea0fb36413fd2870db4d90814af830120ade170f4b2f855c8349f532ba2ff551320b994c44a9a2d75c9
SSDEEP 384:gsxIzw7pLuLcgrQ9XO/PkXqKf/pUZNCgVLH2Hf1MlrUy/zUHGHjkFlO6:gX87pLuLF85O/PkXqKf/pUZNCgVLH2HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c23572997ec4dae38f66de892ede128d022725ac55f34bf7dce02627cc87ffdc
MD5 69d606051254ff00f009fecbe1b3d32d
SHA1 1765d2bc3095d895454bf851199a115e4dbe351f
SHA512 ba760ca6cf7d35fcdf2365eb931ca5d65d493c9d0082f2b3d8e72e9f1d0c4b88308f2937c1fbf432cdd43a2eecdfc09b851daeb848d70918e2f6d860571678c7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5840dc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5840dc.TMP
Size 48B
SHA256 91836ccc3d3c064cb55e13677ce2249520a425a15169ce10542ba547f2ffe04f
MD5 783cc718ba9aa4f76f4013e89cfa3c43
SHA1 387f5f0be187ac4b97eb793659ecefbbd7480938
SHA512 f12da283c8486deeb4fda781c86ac1ca19264d6700c8b20a2baaac1ab7ef82b5c466835e0d8d1ea7a9a0b82b54c127b1f138176512fe95fbe1762508c584eaf8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 76B
SHA256 dd9045ea2f3beaf0282320db70fdf395854071bf212ad747e8765837ec390cbc
MD5 a7a2f6dbe4e14a9267f786d0d5e06097
SHA1 5513aebb0bda58551acacbfc338d903316851a7b
SHA512 aa5d81e7ee3a646afec55aee5435dc84fe06d84d3e7e1c45c934f258292c0c4dc2f2853a13d2f2b37a98fe2f1dcc7639eacf51b09e7dcccb2e29c2cbd3ba1835
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58d3c6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58d3c6.TMP
Size 140B
SHA256 ecfb676535b90e5c86b6d5f1b6994b381276bbeee060504295f8ce79a072d293
MD5 38b20d783a9561cfd48cc4daa5b53929
SHA1 165fb0981d332af76b65d1750cec30fb5922508e
SHA512 553ca343690c69637175981b8c94ab77ba0e19cbb8b1df52c1044db94976f30c5943e0b18ff7a9e970514042ee9284c03051948028ccfd6cb872e7fc4ca4fdc4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 152KB
SHA256 f1ea8a2bc0a37814af45a5d7a061e0296ae8bcb78a036e1789e5bb5ecd385fc1
MD5 91b663e1a6cb00e21c74c0beb71d7668
SHA1 6a9eff9a8d68967af468474493887d653f74937b
SHA512 d7b1e9bc732ddcd46b1198fefb31d6aa94249434e95dabb95d3b8225ac314482bfbda5e417c273c197e1170178b3588c37fae62eb5e2b8ee8d34e6ae20c2603e
SSDEEP 3072:49CWWQg5BpG3urqyBdlZ9G7oRqUiLd5WsQmVk7wWvmJttRBZ:UCWWQg0A/rYoRSLdMNuJtLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 152KB
SHA256 c1fc9608a2a249bd6176fefcc351d082ee19887b5e6f1cd3ba78a6cd038b6e41
MD5 17d498475e2baf75171bebdac82c37ae
SHA1 8b271da7c2fa75cd2b40a919d90d511834922c6b
SHA512 a2bc7e35d29a0bc84b8bb4d9201809c9ff137099be2e99046e4645f909df3707ec99b1f64ee3411ebe88fa0d0b3f2f863e1b968698127a0531c84b931c58eb64
SSDEEP 3072:z9CWWQg5BpG3urqyBdlZ9G7oRqUiLd5WsQmVk7wWvmJttRBZ:ZCWWQg0A/rYoRSLdMNuJtLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 78KB
SHA256 da3b728c4ebe69f0e532a6ebb9cfe07bcba50c4de99cfde1546fe0e70f345d8c
MD5 d385286522def6cc7c11f385411399fd
SHA1 52852e3b55b63f9b0c37e0d4a7c09c7cd9fd6124
SHA512 bfa998557764cfca59ad9bec147e4fe38ea5cdff9df43123c62f6f87bbdb1ea4d90625e60755b914efbe623d5cc40c6baa18a968dbcbbbc4f1c9074c872fae72
SSDEEP 1536:IxyP7XUFOEQBs+Dok8WhL8WvSvMLUHISthRdVd3BO2MutDy3LIxikl:BsQmVk7wWvmJttRBl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 153KB
SHA256 8aed6a1803ad6eb2e18e66a95d759485646b7d2f1c37d8c495b722a537bb1b5f
MD5 9f67912f1a3bd1635e908030ea90ea46
SHA1 45c1a305798f9a25d084fa7afd143b498ccebb77
SHA512 2fb0f13b4011c863fa250d74409d3c95fa6a2529fc41376d206c34e418de995f9137aeaf8afb9e5b7c7da14ca6298c5313469ee506864abae1ee7e5d9471ca09
SSDEEP 3072:vJCWWQg5BpG3urqyBdlZ9G7oRqUiLd5WsQmVk7wWvmJttRBZ:vJCWWQg0A/rYoRSLdMNuJtLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

~DF8E6C1322B93E38B4.TMP

Path C:\Users\Admin\AppData\Local\Temp\~DF8E6C1322B93E38B4.TMP
Size 16KB
SHA256 a4e8d41062ec658b8039385a7fae246241ec1355fce2548b8cdaceec3fe036d9
MD5 c3a4f8c2723fd51468ddfeb601d58a3e
SHA1 543eff9a774aedf8f37624829b7931742f884577
SHA512 ea25f3c59d0a406a3d878d29ded48234a9888579e92b1c45fb1cc106b9a458fa4fc52b930044e0e968cb81f962201a5ad0c9bda46e6a075d79140f26cddfc994
SSDEEP 3:1yVVHjHm/Klclllv/nt+lybltll1lRslkhlEklllyV70yVV7:1yVBGGUFAlkxNyh0Gh
MD5 SHA1 SHA512 SSDEEP

Submit Download