Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
unnamed.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
unnamed.jpg
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target unnamed.jpg
- Size 1KB
- Sample260620-tebhpag151
- SHA256 e7fdb4359ddc84595c511ce0129cd92057ac7590f656302b1f998a313ab26c7a
- MD5 7faeb050336f6df11b8020f8b7e6f2b5
- SHA1 40f7e799bdf516b0235427bc2e9b7242b3de5348
- SHA512 0f0973442189a4fb456094325386f7844fe1969e8e132ffaa2ca99ea178a5b23b96dde9dfb829e715dc54c253158a209601a8a75c4e88bfbde5b61804fa06c9b
- TLSH T134310A1F15115331EF6C7D76C633E619CB256909D3C74ED28282504430A3FFB8B96254
- MD5 SHA1 SHA512 TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4344 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264447141904118" chrome.exe - Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239} mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0" mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000054f2a73b1ae3dc01935a6dc623e3dc018dbb6fc623e3dc0114000000 mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 mspaint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings mspaint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239} mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1" mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg mspaint.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000 mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures" mspaint.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0" mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings mspaint.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000 mspaint.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4088 mspaint.exe 4088 mspaint.exe 3048 mspaint.exe 3048 mspaint.exe 2164 mspaint.exe 2164 mspaint.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3204 OpenWith.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4088 mspaint.exe 4088 mspaint.exe 4088 mspaint.exe 4088 mspaint.exe 4088 mspaint.exe 3048 mspaint.exe 3204 OpenWith.exe 2164 mspaint.exe 3956 OpenWith.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1724 1124 chrome.exe 110 PID 1124 wrote to memory of 1440 1124 chrome.exe 111 PID 1124 wrote to memory of 1440 1124 chrome.exe 111 PID 1124 wrote to memory of 4344 1124 chrome.exe 112 PID 1124 wrote to memory of 3096 1124 chrome.exe 113 PID 1124 wrote to memory of 3096 1124 chrome.exe 113 PID 1124 wrote to memory of 4684 1124 chrome.exe 115 PID 1124 wrote to memory of 4684 1124 chrome.exe 115 PID 1124 wrote to memory of 4716 1124 chrome.exe 116 PID 1124 wrote to memory of 4716 1124 chrome.exe 116 PID 1124 wrote to memory of 4672 1124 chrome.exe 117 PID 1124 wrote to memory of 4672 1124 chrome.exe 117 PID 1124 wrote to memory of 2716 1124 chrome.exe 118 PID 1124 wrote to memory of 2716 1124 chrome.exe 118 PID 1124 wrote to memory of 4888 1124 chrome.exe 119 PID 1124 wrote to memory of 4888 1124 chrome.exe 119 PID 1124 wrote to memory of 4976 1124 chrome.exe 120 PID 1124 wrote to memory of 4976 1124 chrome.exe 120 PID 1124 wrote to memory of 2196 1124 chrome.exe 121 PID 1124 wrote to memory of 3264 1124 chrome.exe 123 PID 1124 wrote to memory of 3264 1124 chrome.exe 123 PID 1124 wrote to memory of 3960 1124 chrome.exe 125 PID 1124 wrote to memory of 3000 1124 chrome.exe 126 PID 1124 wrote to memory of 4464 1124 chrome.exe 127 PID 1124 wrote to memory of 468 1124 chrome.exe 128
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\unnamed.jpg"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3228
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\unnamed.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:4352
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3204
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\unnamed.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2164
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3956
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8cd65c728,0x7ff8cd65c734,0x7ff8cd65c7402⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,127482145602953910,13055796908434609457,262144 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,9844885789808405532,17333596497965075933,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:32⤵
- System Time Discovery
PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,14338671685722833452,14192578293825570463,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2436 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,13648516788290908007,14180958225939604595,2097152 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3472,i,3662194479214710704,7669799790061790798,2097152 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,13850926242386985982,5244483868839657814,2097152 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:22⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,15613284626969736939,8235420829964030321,2097152 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,11674326433406326952,14082764413384688366,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:82⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,9795665366868481143,6797627595471387467,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,16978675524069469998,5897639702282838386,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5932,i,2690378620000122672,8165978809691921636,2097152 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,16395457986617488197,18106728197183204352,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:82⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,4055174580817935204,30056605643410489,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:82⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,16170952276948612000,13632513037751214435,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,9106177246446022373,2794886271650299581,524288 --field-trial-handle=1900,i,8847105200094320693,302054467964257933,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:82⤵
- Modifies registry class
PID:468
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 05aad9eae5a1bbee43e254469d7d81541a7df9b500e081503f3d6da233351a79
- MD5 0cbb49ecc52a057aa712de8fbf37e779
- SHA1 6662daf61f8ee3b61e8a9e0029602b37439a50e4
- SHA512 46baec49906c5b7156fc05b3655635bb1b300a3b3e6997251b293b4873f5cd305e051d97ca87eaa51345d94eef864bca7f198f6a938a0ab64437d6b2e740e21c
- TLSH T18AE02B6ACD22AC2718FD4B1960160745E751135B2F91994F7A3D520CCFB0B6A41DAC6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7602f93d-60ea-4d2c-a12c-4812603fa68c.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 186530aabd674b0bba0b709337c1e7f6a46dd193f8651fce44ff3632af8d0699
- MD5 134f50b998ce7be8bcc2e02df14867da
- SHA1 cdab12423efe711bdf16f6786d8e4c09d4f85f65
- SHA512 b0d7df0fc33f2ab8a9cd863c50e2f43f2d0d9a7093f7186a2cc437abed165b3acea425cc4f255b16e642d15dad6a35e825c7c3e5fc6a5d887400f23bef6caf04
- TLSH T1EB518CF7D3E48A7E851156F4AA256E1FDE290A24532C3C6688D4EF4B53F2872D20138F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0e41d8d2931d979b4fde59b473ecb3e22069b54719ec84efc5332a38333439a4
- MD5 c9b37d7a18d67cd7240f39c062e828d6
- SHA1 21c64ed70afe39d985340b79133d468c9b40b927
- SHA512 42840b7cf0efa5a8acf3235bfc282b6046477866e45542c2d0cfffd27490a7734c1c58510fb05f672d616e79386b6776aef42cd7ba252257170185c74052f7c9
- SSDEEP 192:oRfrqdWhKfNn5v7sp3DPPRp22B59wHsb+WNncGw0KHgxLVj0i7jVyIsnAUgraJ:oRfrKWgZYFrX/nKw80wgnJe
- TLSH T19C52E92EF951693BACC6D229F9227B13D7F9102136941E84E6FCCE1C15EB9CD222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7ab4f503cec20c36d536b9e479803d071b4e14d2ed73cef3d77326154d21a46d
- MD5 977e30115ce9a047e48eada765dadfb5
- SHA1 b5813e8319fa9902bb14b031df0cc1fbbfa78136
- SHA512 6d6a3a1febbc020851ec98bd42f25d9b003148dc04a6e55bb45bcce3ff7ed42d7363cd1ccfca539c90789b6f0105e265b3db6a109af11ce853dfae546a73e291
- SSDEEP 192:oRfrqdWhKfNnUv7sp3DPPRp22B59wHsb+WNncGw0KLVj0i4jVyIsnAUgtaJ:oRfrKWgQYFrX/nKw80Wc8
- TLSH T14B42E82EF951693B9CC7D229F9227B13D7F9102136941E84E6FCCA1C15EB9CD222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 8860974408fc9c165e76331bf3e50523f626cde731e072bb90c338d69ca7c682
- MD5 c56c1fc7b3ab87ca91eb1e58948a7a6f
- SHA1 51f57066e8de1d5d4a3a9e67a6c783e058a1d503
- SHA512 7e10ae13c79bbe9b0fa4abc5136a507ed5edcbaab32c10d60c4db76199172793c162aaa2833f9892f999c90f9c0711477881b467f241054ea191017a36f9aaec
- SSDEEP 192:oRfrldWhKfNn5v7sp3DdPRpM2B59wHsb+WNncGw0KHRPxoVj0i5jVyIsnAUgraJ:oRfrbWgZYFJXxnKw80wRPSDe
- TLSH T1B652D82EB951693BACC6D229F9227B17D7F9103136942E84E7FCCA1C15E79CD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
- MD5 d066f854d368cbebca026e5da297c2c3
- SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
- SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
- SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
- TLSH T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0f106461848c184d4fdd81e335e7a2c1ac903b59107434a8af57a2466b055ad5
- MD5 3c92a9e461b90984005884c18bf59dda
- SHA1 a0ceabbb388c24119e3f8e9eb0819e9e1ccc4de2
- SHA512 6ca0ab285d46db05e02d410076be698133a4f98917220c08ae5d67d9d041ccb4d3435f7f6466a2d85a8f2f00ab1bb1d6f43a92724574e49df23db5fd372f3254
- TLSH T136B0124486015102C49703F029D228C871146F14960A170293E07922C8251618019170
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fa68.TMP
- Size 96B
- SHA256 b3991dd5699a21501258498a9686d5d6d97dde7cc4de389e46fb19a3a8bf0944
- MD5 363eeefa0ccd1a0ae5c83625f1688f98
- SHA1 988f9746dfddeab095896b3f81ab6b0ab00c82b1
- SHA512 fad9a5b3ba0eafd4d3dadb0ba6f712cb6f20876b476fdebfbc031e9cb9c587da210b37477290e60a9ae56fa02f820ae7494dd50ff1e89a8308b499d473d7265e
- TLSH T126B02208C202A202C00303F03082E8CC3020CFE0C2032203A2E00A22EC203300020038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 5f79d392f745988feb599eee49409c296738a16ce120cabd5971c000d715b49e
- MD5 893e69bb9b40ce5df76179efecf98165
- SHA1 17f16b83b46358088006854031b1aa65ecd09dd7
- SHA512 a733e56b42e73365aa632f5a183fbf1d92f9080ccb226754acca734f0bec49493a9189b12b303683c810cda29b23e0867ab2c43b9bb7559f471eb3a7ba75946f
- SSDEEP 3072:QtoSKa6qMwgCh3hodf8U8+RhpN+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMu:Q2wgARsUiRjm7Rkm1tYpBeh2BAou
- TLSH T17734223D1D95AC3B5DF6B708708F5BAE1E75CDA2E428C95280EC6F0872A5EC94543E38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 ee46f95abcf4c5855322ef68f2e5332b5c68d99613442d19c2ea81ab41e2de88
- MD5 2759f2a4c23deddd03cff38b9742fb92
- SHA1 bd8e9548900f8a202190da075f709857d5a9c5d3
- SHA512 85e6438cc2a779ce4592cf8281579372ae8f17eae594726002eb5968a847a5d08186a95020850c2e791356c9a9e053b6c995c08684e055862f5d71d1e60c59cd
- SSDEEP 3072:k0toSKa6qMwgCh3hodf8U8+RhpN+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMu:k02wgARsUiRjm7Rkm1tYpBeh2BAou
- TLSH T15034123D1C51AC3B4DF6F608B04F6A6A1EB5CEA2D42CC95584EC7E0872A99C94943E78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 ccc3551cd0989e193d2ea1f2ed1fb4d463083ebde80dc13f98293323beabb250
- MD5 a5709f145511ab3d0a55cb39d6ade498
- SHA1 0fd7a1c46b2d25e3dbf8dc501cd023ff75a28060
- SHA512 348e7d56f80df01202729ca20b86b0adb1ecabb16170d82f3aca8ae7e73e166190d97d47af59032718073915a2a7a7fc2b86fbe076ab963b69b18e063099f1f2
- SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:7m7Rkm1tYpBeh2BAoK
- TLSH T1DFC3123B5D65E9779979B70EB08E0B1F1EF149A2D920DE92C8D85B0437EA7C90A04D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 efed735c7eec84e1ba224364aa88f119d9c93cf6758b348999e4769a6df3a335
- MD5 7fe2f6628911c4b764d1f5915fee04d3
- SHA1 05d0ca8e0ade2a78c8d3dffa55bcbdb110607265
- SHA512 9547f58107895bd19977d7156c01a202b4a9110fccc94d6c93a13bb32d0950079caba19231eca4a58f69b9f285012502623b04ad8b1004c12747d165716279e7
- SSDEEP 3072:DtoSKa6qMwgCh3hodf8U8+RhpN+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMu:D2wgARsUiRjm7Rkm1tYpBeh2BAou
- TLSH T1AE34223D1D95AC3B5DF6B708708F5BAE1E75CDA2E428C95280EC6E0872A5EC94543E38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\unnamed (2).jpg
- Size 1KB
- SHA256 68a0df4544c742d11bdce08248bac0b3823913e674d99bba55f845ef072fffbb
- MD5 f68900a7f646b86562376c7488633bbb
- SHA1 28cc995ac1f46e9996c3bc2ecb35999f8e832073
- SHA512 a1b0854ec660d3689647ffc3a6f26f4bab814cef70ef5a155cf8838c859db3b31fbf535a5701c68878e18a04410249e3aa09dca1a81f1002a333fecf462e83a7
- TLSH T19C41FB0B67252E4078E18DB72E86C427C39FF68533372319683246E6F60409692E4538
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\unnamed (2).jpg
- Size 8KB
- SHA256 ad34c3ad24cad9e05c51caf45a52ec0538460986c9a5d968e78bccefdd45fdac
- MD5 437ea5cbbcddb56db23283705e0a1bda
- SHA1 24439f139c13e447813be43955350984eab0405e
- SHA512 2449b649920bf8763a20db0b02b7260e0e42e9a5bc3ac4a69feecfe2bf1e7d5619115ab1b1e15c5bafd04fe7175cdd146b61979d470393893df6118efc061127
- SSDEEP 48:HyIQKkh3scD2QXuERAj5e47sAYPVkmi3e28B2Golvc9x/H6Ytb:SIRCFeEmT7ypqe2ZFlvcz/aYtb
- TLSH T118020A0E6A253E40E8E1CCB328C5C41BD14FE24733532D19747E85D7FF141A25EA56A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\unnamed (2).jpg
- Size 8KB
- SHA256 0c47a531b6cfc1524afce18afbd83d191a68e353ffce86ffda1839afd62c4e0f
- MD5 02486ae6a7759bd7b05ea08c7edc1e1e
- SHA1 06904601f99a3c9c0c8262adbc968132ba188fed
- SHA512 968a8a99b2cccedb60b0f36e8d7562e491dce8fc72413d4d126704384c971cfb5e73f2379b57f8562786391dc66896e456347dd300d815986d6f9b0b45ef5d3a
- SSDEEP 48:tPKkh3scD2QXuERAj5e47sAYPVkmi3e28B2Golvc9x/H6Ytb:tyCFeEmT7ypqe2ZFlvcz/aYtb
- TLSH T149022B0A6B253E40E8E1DCB328C5C01BD25FE18733573D19747E85E7FF142A25EA56A4
- MD5 SHA1 SHA512 SSDEEP TLSH
