Analysis
- user interaction
yes - max time kernel
959s - max time network
965s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/06/2026, 12:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://release-assets.githubusercontent.com/github-production-release-asset/32575637/956207d2-8478-4827-9986-ee3fc8fccb04?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-06-02T07%3A14%3A00Z&rscd=attachment%3B+filename%3Dgost_2.12.0_windows_amd64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-06-02T06%3A13%3A14Z&ske=2026-06-02T07%3A14%3A00Z&sks=b&skv=2018-11-09&sig=lHvS0u5V%2Fqu8O2Pt4MMoflI1EoT6BhWL%2Bb9GUSiWUFw%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4MDM4MTczMiwibmJmIjoxNzgwMzgxNDMyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.2TshRS6Mb5ebKoRXuPG_2u2A8tLNxYduxbAS
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
https://release-assets.githubusercontent.com/github-production-release-asset/32575637/956207d2-8478-4827-9986-ee3fc8fccb04?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-06-02T07%3A14%3A00Z&rscd=attachment%3B+filename%3Dgost_2.12.0_windows_amd64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-06-02T06%3A13%3A14Z&ske=2026-06-02T07%3A14%3A00Z&sks=b&skv=2018-11-09&sig=lHvS0u5V%2Fqu8O2Pt4MMoflI1EoT6BhWL%2Bb9GUSiWUFw%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4MDM4MTczMiwibmJmIjoxNzgwMzgxNDMyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.2TshRS6Mb5ebKoRXuPG_2u2A8tLNxYduxbAS
Resource
win10ltsc2021-20260513-en
General
- Target https://release-assets.githubusercontent.com/github-production-release-asset/32575637/956207d2-8478-4827-9986-ee3fc8fccb04?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-06-02T07%3A14%3A00Z&rscd=attachment%3B+filename%3Dgost_2.12.0_windows_amd64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-06-02T06%3A13%3A14Z&ske=2026-06-02T07%3A14%3A00Z&sks=b&skv=2018-11-09&sig=lHvS0u5V%2Fqu8O2Pt4MMoflI1EoT6BhWL%2Bb9GUSiWUFw%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4MDM4MTczMiwibmJmIjoxNzgwMzgxNDMyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.2TshRS6Mb5ebKoRXuPG_2u2A8tLNxYduxbAS
- Sample260602-pn834aev3l
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5608 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248769993536344" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "5" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{B937DD15-9984-4883-821A-CF695EE1480C} chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000556c650c06e3dc01838eb1f00ee3dc01a876c4b48cf2dc0114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 736 chrome.exe 736 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe Token: SeShutdownPrivilege 4308 chrome.exe Token: SeCreatePagefilePrivilege 4308 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe 4308 chrome.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3296 chrome.exe 3296 chrome.exe 3296 chrome.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3992 4308 chrome.exe 83 PID 4308 wrote to memory of 5032 4308 chrome.exe 84 PID 4308 wrote to memory of 5032 4308 chrome.exe 84 PID 4308 wrote to memory of 5608 4308 chrome.exe 85 PID 4308 wrote to memory of 5024 4308 chrome.exe 86 PID 4308 wrote to memory of 5024 4308 chrome.exe 86 PID 4308 wrote to memory of 3836 4308 chrome.exe 88 PID 4308 wrote to memory of 3836 4308 chrome.exe 88 PID 4308 wrote to memory of 3920 4308 chrome.exe 89 PID 4308 wrote to memory of 3920 4308 chrome.exe 89 PID 4308 wrote to memory of 5240 4308 chrome.exe 90 PID 4308 wrote to memory of 5240 4308 chrome.exe 90 PID 4308 wrote to memory of 2096 4308 chrome.exe 91 PID 4308 wrote to memory of 5856 4308 chrome.exe 94 PID 4308 wrote to memory of 5224 4308 chrome.exe 97 PID 4308 wrote to memory of 3192 4308 chrome.exe 98 PID 4308 wrote to memory of 5368 4308 chrome.exe 99 PID 4308 wrote to memory of 736 4308 chrome.exe 105 PID 4308 wrote to memory of 5968 4308 chrome.exe 106 PID 4308 wrote to memory of 5968 4308 chrome.exe 106 PID 4308 wrote to memory of 4568 4308 chrome.exe 112 PID 4308 wrote to memory of 4568 4308 chrome.exe 112 PID 4308 wrote to memory of 5444 4308 chrome.exe 113 PID 4308 wrote to memory of 5444 4308 chrome.exe 113 PID 4308 wrote to memory of 3584 4308 chrome.exe 114 PID 4308 wrote to memory of 3584 4308 chrome.exe 114 PID 4308 wrote to memory of 1264 4308 chrome.exe 116 PID 4308 wrote to memory of 5760 4308 chrome.exe 115 PID 4308 wrote to memory of 1264 4308 chrome.exe 116 PID 4308 wrote to memory of 4680 4308 chrome.exe 117 PID 4308 wrote to memory of 4680 4308 chrome.exe 117 PID 4308 wrote to memory of 1284 4308 chrome.exe 118 PID 4308 wrote to memory of 1284 4308 chrome.exe 118 PID 4308 wrote to memory of 3840 4308 chrome.exe 119 PID 4308 wrote to memory of 3840 4308 chrome.exe 119 PID 4308 wrote to memory of 3296 4308 chrome.exe 120 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://release-assets.githubusercontent.com/github-production-release-asset/32575637/956207d2-8478-4827-9986-ee3fc8fccb04?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-06-02T07%3A14%3A00Z&rscd=attachment%3B+filename%3Dgost_2.12.0_windows_amd64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-06-02T06%3A13%3A14Z&ske=2026-06-02T07%3A14%3A00Z&sks=b&skv=2018-11-09&sig=lHvS0u5V%2Fqu8O2Pt4MMoflI1EoT6BhWL%2Bb9GUSiWUFw%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4MDM4MTczMiwibmJmIjoxNzgwMzgxNDMyLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.2TshRS6Mb5ebKoRXuPG_2u2A8tLNxYduxbAS1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x200,0x1f8,0x224,0x1fc,0x228,0x7ffe8345c728,0x7ffe8345c734,0x7ffe8345c7402⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,7338053734026568042,16591681476062332654,262144 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2004 /prefetch:22⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,592951228080835817,11765449501851001210,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
PID:5608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,13660166269813622270,6617718211271385701,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2272 /prefetch:82⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,11284480770134549605,13935794716450736059,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,16857744059524779966,6925077461687851735,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,13680692195087436947,13599756598480849914,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4280 /prefetch:22⤵PID:5240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,15584812997331659473,1261162502239161410,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,13050361107388706456,10702173653561501016,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5748 /prefetch:82⤵PID:5856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,1955760826365125426,1040287586513237151,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,7167686822336626690,16985728382691310133,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,12154564878004973283,1118209198889184973,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4260,i,12426748572774294873,2756511646232272214,262144 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,13358878766229770830,5520535544613837923,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3884 /prefetch:82⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5840,i,7942379675153854585,5259860643578427342,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,4053017939809736982,5510221826835185075,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:5444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6268,i,7375835797970298291,9701365661254462765,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6204 /prefetch:12⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,837398649498311900,17509862944949077642,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4276 /prefetch:82⤵
- Modifies registry class
PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,5280798326345487506,14432432181038223026,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6100 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=1544,i,14095180131820154489,14147561944692538354,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6456,i,11878001858703782912,18303187180972514887,2097152 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5912 /prefetch:12⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,12199505994519801665,5076368638456379618,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6628 /prefetch:82⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,10229850564040615222,10906744098498058147,524288 --field-trial-handle=2008,i,5697873905184786220,1419879360558698952,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6640 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3296
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5820
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7d80d943-7b8e-48a2-b233-da6d0d3e245d.tmp
- Size 5KB
- SHA256 ac4908aab6372903013e2b612391ed94665bb4fe2dcbb16295e6144aa3c882f8
- MD5 75a558224299bf89738e42bcfa214528
- SHA1 d4867395337f9b779af5322e7d1c9c50aec413e1
- SHA512 709039ad469fbe8dcbf006c08b88a181c90afb175b8391af4b6e7fbef3953937505efb4f3bcb0a2e5f20ed9d796c8d3bd6adf4f5e10c10ed9dce6dfe314b53ef
- SSDEEP 96:eNC0d++nHQU0Ttfy95z4CRDotok5O0DPB6PJGyvyL9QNdHBC1Zwh11a:eNC0RHCw955DUDZ5o0N9QNdHBC1q1s
- TLSH T1C9B1E9B6D86A8C77157B85C6F5066B06CFB8B0EBE6609E989DDD0F0D11EB0E81302532
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 b20bcb413dadfce253e54ee69ca23954b62f243bb424dc2aa7b8ef29c95ad753
- MD5 bc355a31a99d227314be3815388e1e0f
- SHA1 a033c1d04fff22e3b388da0ac7e9d8d8076d880a
- SHA512 80a0f5ff8d75ded5b7ca936d11147b7c425208a5360cc55e5955e777448cd958b677e5a547beed3f6cff63ad70ccdc75229b339205172f319cf17eaf587b3ca8
- TLSH T1D6F02DF9C9219C7718FD0B2D20544746F78113672B90895F7A3D420D8FB573B459591C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
- Size 374KB
- SHA256 aa5482a1cb0e0e9fc7a09d90ce82d48765958ef2de12bb567c9a9dda0e70fe08
- MD5 573e467d73dbee9c030ab6dd911a4ba9
- SHA1 a7b2b2064ed4736ef28f3cb83c8d465343516927
- SHA512 bc46278aae28a4c5952e9db988efae23e53d6e1eb3edf8bb92535ac93aabbe5cd97ed43b301722c61a0d692fa1f99d356822ade6f0b769d47be741ecff5516fe
- SSDEEP 6144:2FMjqfaRkLaFLdTF5AHl+qC6naJJwUISq/1uwj+mN+MBtpc3WhHfVl:JjjCOFLdTF5I+qbaLV+yA+AtqWZb
- TLSH T1C98423A376B1F0AFDEC8697F03C63363A598B531B7D019C61D48B2A6122735C9FB4264
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 c70b3cd010a2ebdbcdd598e33c776fcfe0a297f14eccca96599a72dedcb330a6
- MD5 9a122626c613631e640b2f0837785fbc
- SHA1 e9f6ae0670bfee0e0eb5aa9f770f4cf8525aab59
- SHA512 c57c42830b3c300e59652900f760fdcde686e065349bd4c505031c7bde97464ecd257e5d387488150ed55fcfc24aef2a0bb9722dcad5e7493988474bea5c22e4
- TLSH T17031C78840D14CC2CB5F44316CC66C8D38B30D4718037E021B662D73A16BFB792A1EFA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 79da9943bbd594e974b287d02a58f150e5a3378aaaa5faa37392f25a46395683
- MD5 8b9f66e337e0547a9208dfe099ca9dee
- SHA1 c7544fb5d6163258ec07a1d6d1700fb17939c599
- SHA512 c057ef40efbe339c32db6bafbd856b533b41f36b3b698348aec7e39ae412af32912e427dabb084b66cb6279c5d6b8c2282bd49ccd726e169ee79ab5ef7fae8a4
- SSDEEP 192:DHsYfw9Y1Rjkxs/CFNyasOjhtqpakFRC7gtmYlOKEGu2Yr9t:DHsYfw9Y1Rjkxs/CFNyasOnqpakFRC7Z
- TLSH T1DD229FF3C3D8C62DC81166F5AB257E1BCD2A0D2453283D66C9D8EF8B67E2472D25064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 11KB
- SHA256 fae9cf7761d45cbc6a4c5192c69bcad61effe22d7f3ed4434c50b33a05a72a27
- MD5 6f1f9ba5374f446705e0630b2d0e2558
- SHA1 f54cd6f878fb5cbe882be359402b00b63b6ed1c7
- SHA512 651d6310693d9035c89958eb5b74da601b498ec76e21cae2ae24857d36e8a41425325e173db4e1b3344708bbb6a4ca000c451914f33d3c000d641baeac66329c
- SSDEEP 192:DHsYfw9Y1Rjkxs/CpsDNyasOjhtqpakFRC7gtmYlOKEGu2Yv3F6Xu:DHsYfw9Y1Rjkxs/CpsDNyasOnqpakFRc
- TLSH T1BA32A1F3C3D4C62DC81166F5AB297E1BCD2A092453283D67C9D8EF4B67E2472E21064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 95c7f8d2762aabf426dac730bd826e956563ca1788faa5f907b2866c37167afa
- MD5 1d7492110de913a607665dd3ae3be019
- SHA1 b319f0ccd93d7b3f695c0f0d81aac770a800c0c0
- SHA512 779623784d74e9cabb2bfa1a2d386b638e10ac69e1ec8cfc2a434deca6c994a7ec281a7508da7bd18c9495366af94ba4e29a19dcf909009afcb4d93b6133d912
- TLSH T12E51AEF7C7E8867D890156F4B7152E2FCD690A14536C3C56C8E4AF5F53E2871E24098E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 f4c37bfa78d3de1842c8d0a4a072ce82cafdc2c92b7cf1b2295e9a87e0614b42
- MD5 d2491245d3af43789cf852128cd0bd99
- SHA1 0948a67993bc7c247ec9c2c2296a8037cad977b1
- SHA512 f8acfbea41f542c351fcbbaef98551aed600570b58f900bf8fda4943e8e4beba94cc5d5fe90ed54f72e49fa59ea0796ea94a6ddf6dc9765f753c5b83f2c613ab
- TLSH T103519DF7C7E8867D890152F5AB152E2FCD690A14535C3C56C8E4AF5B53F2872E24068E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 9KB
- SHA256 fffcba81a0c20788e32b18b70c01273e8c6a48b9d7c81a761d13f12194f75481
- MD5 599f1e97b77d7c041d7a53d54257b47c
- SHA1 84bf4fcad73e1d641a8827a35c10b03f063f0f09
- SHA512 10a85ac6b8db458ac42596ec1695898c16a82030778baeba5062c57ed41fea777783cc750f21e1a20a54dc144a1a65368c6d36de6d861598340a014713c2f4d9
- SSDEEP 192:DkOh1itHAW/PxqeGszVNyasOjhnEdkFSZ7UmNYJzKExyRYG1bXZrq6:DkOh1itHAW/PxqeGszVNyasO5EdkFSZ3
- TLSH T153127BF783E4C62DC90166F4AB297E1BCE290924536C3D76C9D4EE4A93E2473E25074E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 c7ff57183a7207f7ff1d48738337c94c7520a998b0c8ce4cc06c8596ceebd2bb
- MD5 250071f9ab358c75430deb9fc6b649f2
- SHA1 46ec32a82e7b2215096f4dae270ca572494c43ff
- SHA512 f435d7e4a6743b31eb1493dc3c88f2f0e6da77250e6cf95b962dc5f3f6edb47f6bdf6eb5851cf73aba88d8e42c4c18fcb8e15f44318bbaf24e68c57f97dd3e40
- TLSH T14F217CA79A6EB46790681A7F0D05B80959BBA43112805CF4CE6BC23DB0919E30F12467
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 be9e09d220c3ce97bc03ca522a7c4b19099d854a4e532cd32f2fc0de57800bd5
- MD5 62d0e33d3475fdd66f298fc08fc8dcf8
- SHA1 31120bf9d6f69e0115bdbff0a279adf1974423c8
- SHA512 a1c5b067adc4b44d244ecf31ef4949d90fed20e2131980f62ee6f44998542a00bad21299d48d0595ce1d6e9bbbac5f4c2f010ff240dc9f6f9c17078f0be93282
- SSDEEP 192:9RkptyrutPv7dpAPRp2c97Hsb+WNnQjPynU2mQeDQgVyIsnAUge:9RkpxH5UXDdwwPeU2mhTe
- TLSH T13C42A72EAA20697B5CCFD22EFA357B57D7F5103121942D44E6FC8A2C15D75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 6f6722a3cc2d2896cb9455f4565d7bf43cf339ee9b8024be9e75d23a44bc8de4
- MD5 609e5841274ffea8bee5d4b86334e5f7
- SHA1 f5dd930f8e3ab2efa84c088e45e57ec4026199cc
- SHA512 24ad4e4ec8dd1cce1b6148ba979d8b6c4b0a773fd39a0352c2d6b027c49f35c33c24e0147c5d1c5a69276741e28d78b813787916302e9160cbef0567fe5cd4f5
- SSDEEP 192:jR0cBzpgyruFIv7qQpPPRpv6UAGW97Hsb+WNHi/GN4Nq07hXJ8fwnU2mQeDQrVyz:jR0mzpwU2QNXydwkYD488U2mhyK
- TLSH T19C62E82FAE20297B9DCAD22EFA75B756D3F5202162C41E88E6FC8B1C15E75CD2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 b93becbec9ef645b026ddcfe3d8b4c71ebacf854677431622bd94886feb7e8fe
- MD5 e135048bb810d8440d00f886f6e7ec83
- SHA1 4d098601b1fea035f567e8dfaac46730b16bf083
- SHA512 018f91a8e88925e6105828143336efbc73af4a9361b38ccac2ff06f8cd92bf3b1b733d79e2f6736906400cbf6373ce26bdb7b533a4fbf8bb94561db4fd20bad7
- SSDEEP 192:jR0cBzpgyruFFv7qQpPPRpv6UAGW97Hsb+WNHi/GN4Nq0jcsfnU2mQeDQrVyIsn5:jR0mzpw12QNXydwkYDdsfU2mhyK
- TLSH T1EF62E72FAE20297B5DCAC22EFA75BB56D3F9102162C41E88E6FC8B1D15E75CD2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 7189f01a83643226d2f5a131b903e5d6ca8a33e64409a22b356a9da63b2c52c7
- MD5 a5770005b1675e4a2a9d4ebf3cea3f94
- SHA1 417915869569c5f3534f06a23c194907c2496b0d
- SHA512 ac66aa2ebd0e62676f2870c6a6f8d8b53370c87d156cab1edbb937407b59ffa2aaadc7d3ed24adc3c862c2299cfa6bc674c48034eaccd2a6e2ec28a228e51638
- SSDEEP 192:jR0cBzpgyruFsv7dpPPRpvBAm97Hsb+WNn/GN4Nq2QnU2mQeDQqVyIsnAUgE:jR0mzpw45NXNdw/YD2EU2mhjE
- TLSH T18952C62FAE20697B5DCED26EFA357B56D3F9102122902E48E6FC8B1C15EB5CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 50b5525406e652df838c9f67073bd53ae711ae4f3c0898220c493ad087744e07
- MD5 dabda913e35e4744abc25af9bbc97a8d
- SHA1 bc9a7d12f915ed09718a92965a9d11af8a88e252
- SHA512 168fc80712362f5df3064f50b349294c0ee4e1a61b715025d2c151fae3687b582606027d790b4ecd3683b67ab82d63da6a36fd0c91f82e52d6720aee34fedfd7
- SSDEEP 192:jR0cBzpgyruFsv7qQpPPRpvBAGW97Hsb+WNHi/GN4Nq2QnU2mQeDQqVyIsnAUgE:jR0mzpw42QNXqdwkYD2EU2mhjE
- TLSH T16C52D62FAA20297B5DCED22EFA757B57D3F9102122901E88E6FC8B1C15EB5CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 2b3cf3b8153cf5b1647620db1ed4314b23cc1738a540b8f395648c1e9a4fc110
- MD5 56e2801e1fa0fe1b9a423b9edba257ec
- SHA1 ae4846364096f83415c4f4b00774944b48ab8663
- SHA512 fec34e11f5b5384ad768762a3262e7c8b265415fd3d8236415c3b12da636f93b562b2845109bbedf16444fb647f49846f28c5cae3a9c000df511bf6fc9526e0e
- SSDEEP 192:jR0cBzpgyruFnv7qQpPPRpv6UAGW97Hsb+WNHi/GN4Nq0V5o4nU2mQeDQrVyIsnv:jR0mzpwv2QNXydwkYDooMU2mhyE
- TLSH T1A052F82FAA20297B9DDEC22EF975BB56E3F5202162C01E88E6FC8B1C15D75CD2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 492090bf54832d531775ecc9f9e075186f69bdcdebc78a00a5692cf119e64ccd
- MD5 1394941c2af45304efc0454a949e4da0
- SHA1 0bc34992de4eaedf2a441df1a31918d543a63b64
- SHA512 9f4694a3c26dbdc06697cf5881d6201e6cabf4f35e5e3e37f7b689c5b0f710ca31236874c9ce1aaf090d568eebf6be38fdcba42c680d345abf757170509db2a9
- SSDEEP 192:9RkpgyrutPv7dpPPRpvc97Hsb+WNnQjPtnU2mQeDQqVyIsnAUgE:9RkpOH5NXEdwwPdU2mhjE
- TLSH T1C142B72EAA20697B5CCFD26EFA257B57D7F9103122901E44E6FC8B1C15E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0fad73a822670ea268a437ce1c8628028cbecc971dccbc071dd437aaeb3053a2
- MD5 caaf60c3edac8568918cb944c50fc0c0
- SHA1 7537d330297d631477423d9b36a75c59c6fefc76
- SHA512 01dc78cd59eb532bf490d72ec748768719ef576ef581970f459eae8e1a5b478fda479f2b267a16c5d0ace736d105c424c7994b64d236cc3425f6f16bee2622f0
- SSDEEP 192:9RkpgyrutUv7dpPPRpvc97Hsb+WNnQjPtnU2mQeDQqVyIsnAUgE:9RkpOQ5NXEdwwPdU2mhjE
- TLSH T18B42B72EAA20697B5CCED26EFA257B57D7F9103122901E44E6FC8B1C15E75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 46e584a7d05a795bff08fde85d7d74764aa4760bd3b57af1c9875a8a930f234c
- MD5 16c4da4eeacb9f56e4e0de6d456278a3
- SHA1 633d2a012ef8baf9f25cca3be3f26bd6a67de53e
- SHA512 96db9756497a90e2b0b2aa91cda5623be793bd1a51cccabf4f357c7090c62f4032b72a7a3f9e5fc64f20c305480173806e9d774a5e0f67b4cfe9a82a86b6e7ea
- SSDEEP 192:jR0cBzpgyruFvv7qQpPPRpv6UAGW97Hsb+WNHi/GN4Nq0nvEenU2mQeDQrVyIsn5:jR0mzpwn2QNXydwkYDcEaU2mhyK
- TLSH T12F62D72FAE20297B5DCAD22AFA75BB56D3F9102162C41E88E6FC8B1C15E75CD2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 6646989bfcb5c97513acdde7bf1e6a934ad9e4a758723746e8ad756689192b52
- MD5 a53b398127eef947fb45f97818cbc504
- SHA1 feb83c16e01a91151075652e72c375abfdb60d64
- SHA512 7d4597211aa3b5d84a9750798703e7119d689c2b5783eba16dc6b3a7fad248d1392de105073b4174c487374230945692a752279764d5846cd7995ff455d202cc
- SSDEEP 384:UOjwL7KxkXqKf/pUZNCgVLH2Hfgsl5T7pLuLcSjGHXODwn+ErU3uZHG29t8OPHu:U+wL7KxkXqKf/pUZNCgVLH2Hfgs3T7pe
- TLSH T16772F8A76C4C9E370FD8C5CCD82A7B4FADB5024B65E9886482FA581903D5BDB11062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 9247b9b4a1500cbb6d747780be80709a0fe8d8eea7418c04cbda38340b037ed2
- MD5 0ed9af7b3f4d5a1472e19420571c089a
- SHA1 8471221587e27f1a2d357d98f03a4be13eb92ab3
- SHA512 1e1160f9d3c048f42d902292128327867a7d1590403da9fc560c18b169c4f907ab095b0234d924a19371e4b2c8cc0954e6b93720b6d0e546eb11f41a2ec2efb0
- TLSH T15FB0120080415542C44303B021461D8871149F10AA0A170183E4A922C826771C418050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 a4a518b78309e7b327d58bd4e12d879f731a7f39a32fa75f50aaf5ae3bbfa06b
- MD5 c9e745815da9e247a0c6f8fcd9a20869
- SHA1 515c293ab9bac1703cfeb95629512136522c4219
- SHA512 cf249166d77d316fece4b66f1b90d1716959f994895ca3adee76962c58825905b34fcd41abb2bb5bced9412a6789b5cfd766a9096dfdf8f4807f060b9b9956c5
- TLSH T1CEC01241C042E171C05713B42863D9DC73145F64CE1F134C53F0693BDC34721C026155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587d59.TMP
- Size 96B
- SHA256 0cf7fa4963b5b1ed7214ca8bbcfec387ed516c071d3897833af9e29e70e4dc25
- MD5 1a36e7fb8b3cac65cfa000efd5964847
- SHA1 85fd2c91c5a5999bd23a04818c692ed54121944c
- SHA512 892697dfb9d9fc5aa22bbba460efa9d7d06ad9e16a6ae493ada84ea56f39bce40d4fb3a980ffb198fad911c6c3c400204711b71c6b99d90d8bacfc87466b4533
- TLSH T192B0220EC00222A2C08203B02883E0C83020CF20C203032283E00B22CC2AAB00828230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 c70bdcc0c13597295932e4014f92a6b5bf5aeec9d4d59876a3ba06b3045f7e0a
- MD5 f24a32319cf1137618b3095e28cc987c
- SHA1 d0a3750d6ecaf2c7832a45b3544c482502801ef1
- SHA512 556d38a46940763d13ade5f895c4bc158a482a2a51c98a0978b2db41dccba8dbc97b201a3ad0effa0785c986936cdab17d26a92ee537da6ba97edec339111c37
- TLSH T16BA00224C5901477EE29077224AB2578BA90492006030A0185D01069BCA49808212040
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 50ab0ad3e008050d8886c01584978e3adafefaa7bce9a598001c46db2d5a2a34
- MD5 380d4d48920b279e4e152c914778e705
- SHA1 ece194198ba0ee9e6e7c513c204d883c5f6076b2
- SHA512 c1ad115f047387b8e40bd9f03a1d8900e9a9d8f9c88833bc1007cc19a3fd34ecd1d176066a0520338277f07d028054b35e64cbbee224398c1dbb3de423e0c6c5
- SSDEEP 96:eNbJ0d++nHQU0Ttfy95u4MSl8h4otop5OcDPB6zGyvyL+hSxMdDnNC39IVyVN/ZN:eNt0RHCw95kiU2J5fN+hSxMdD4xJK1s
- TLSH T10AD10AB6D86E9C6709B7A5C6B1037E038EB8A1ABA9147D58EDD95F0D01DB0DC1343533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 73bdb243926e4826262238fcf9f4bbe13931a83baa1474eb7b18cdf2bdbd2c74
- MD5 8f39b8ef7fac1a8a4cfbfe26a93402d7
- SHA1 1bec813dc2425580c9ccbbd6fb50f3406c4f0f5c
- SHA512 03da10b5b5352129315581c704574f6c72a3d733ad4fd47c71cdb2d186c2a3a63b0db0837663dd18c5bd83456d53d3306b8c5dfce391e7c0bd946d61a6ef57ae
- SSDEEP 96:eNbJod++nHQU0Ttfy95u4MSl8h4otop5OcDPB6zGyvyL+hSxMdDnNC39IVyVN/ZN:eNtoRHCw95kiU2J5fN+hSxMdD4xJK1s
- TLSH T145D109B6D85E8C7719B795CAB1036E038EB8A1ABA9147D58EDE91F0D01DA0DC1343533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 e39b7fa61353e9bb31e2d3a8533236e88490047b6a3ac301b4771ed2b99b88ba
- MD5 5b7903a055bd5f38108d614158c830f2
- SHA1 1a0cb958b8656e243dcbb91ee7d06bb33bda7fb5
- SHA512 d2c3fb8e53a28b22fdad47e3e6a9a0f420ddb3ccc02620148b75b4af9986ef458434adc938f31bf635a8d3433f84d80532e94101d4c3b7fab769332bcb27fe4e
- SSDEEP 96:eNbJod++nHQU0Ttfy95u4MSl8h4otop5OTDPB6JGGfvyL+hSxMdDnNC39IVyVN/r:eNtoRHCw95kiU2o5EvI+hSxMdD4xJK1s
- TLSH T165D108B6D85E8C7B19B7A5CAB1037E038EB8A1ABA9147D58EDE91F0D01DB0DC1342533
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 722548069e2d85fce256d782444ff700a4a9e5d1e2706e52e0eb4da48abbc328
- MD5 1f0732419651722c81b8701cbacae83d
- SHA1 066ddf23fe8f4833917ab431147d8e73f6bbf0e0
- SHA512 940fedf0c102c5db7400c3e4b5d64d7dee730a1b45f3d7fd9fd457380aa78071c5af8be9b8e525d0e2bb57493dfda8c01f5b8e565066fb2cab03fbb0aabae9d9
- SSDEEP 96:eNC0d++nHQU0Ttfy95u4MSl8h4otop5OcDPB6zGyvyL+wV1mm8ExSrMdL0j9ICJx:eNC0RHCw95kiU2J5fN++8ExSrMdLUE1s
- TLSH T1A0D11BBAE46A9C7325A7929AF4063B47CEB8A0EFE6505E549DD90F0D02DF1EC1303532
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 68db42a085eb90d449b6dc2f7515a7048154584d7133f83b8a29d57480ee4177
- MD5 dbd7154dcfed410734ff3cac241787e0
- SHA1 4cc39fb98e88da7b051a206da8c8664864378193
- SHA512 d81cd0c13d85528ed44242f62bde2f3f4cc9c6d8a92716189b858d13950a34af0c50b60b0dd8a7965a4cd473a11c6f5f5061fec2fb53d76fd54ba513169bc11a
- SSDEEP 96:eNbJ0d++nHQU0Ttfy95u4MSl8h4otop5OcDPB6zGyvyL+wV1mm8ExSrMdL0j9ICP:eNt0RHCw95kiU2J5fN++8ExSrMdLUE1s
- TLSH T115D11BBAE46A9C6315A7D29AF4063B47CEB8A0EFE6505E549ED90F0D02DF1DC1303532
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 ead7a34ed529c1d7a6f2a05a8adcea1b6d7b54796b369b518529b2bd10e5847b
- MD5 0eaa2f0bc29999c05560aa2d9feb2b62
- SHA1 12b5a3444fade9de4ef99c63f4de3964ffe60fb0
- SHA512 1a7a223e78d0a20a9f211496b43d3d515a28695f66ccb78ebfb49a292c3f0f893bbf85e8e2819ef9aefbcb038354f5f9928aa1fe8ff3eb194d400bef54ee0d80
- SSDEEP 96:RMOmYvstZBL/2dAMhBxZb7zSbCgG6OLyyzjSFQDwbWQAGN:Rba/BLOjhBzb7lnjSFWMN
- TLSH T1D2D2A652B408E602EE4D2C72AFEAE2DD36713D16DC5A031335D0B33F49BB8C10D59199
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\gost_2.12.0_windows_amd64.zip.crdownload
- Size 5.0MB
- SHA256 2ebe0cb6ac5e966647b222a1f5ac1ae4ce1f340e190f5f69e381c4f694526d43
- MD5 7e28bc03af67985ac490815a2f849d10
- SHA1 082843397a53bd51c09b2b81cfb59cd80f202d84
- SHA512 acb00ee4ff4acdc7354b72b5e94e3e1b2002c8e04a9a3de32ade478a6a2c1ddc580d96cb3752125c05ac1b30aaf312325f44f8ee833aa5723bc52b7b4a96fb1b
- SSDEEP 98304:YINly5pYKeaYjVAX8wk82pu6dwiUNRHJeJeEzTLFcC0/jZ5Zk6uBY68qI4/2Xckw:VNQ5qKeaYnnISwiUfpkbzTLKTZ8lB53j
- TLSH T12236332B19AF1BC7913D8778FD244E44F38076418FB3A97A2036CB3AE8474799505B7A
- MD5 SHA1 SHA512 SSDEEP TLSH