Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PetSimBot.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
PetSimBot.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target PetSimBot.exe
- Size 1.2MB
- Sample260723-sjd9psbf59
- SHA256 a2ec220266a0e2439e951b597421dbc51d2245ac7b69df4fb642ae38f0fd8f56
- MD5 4f7685da26ed6eed879945b63fda9143
- SHA1 7cae8edaae65c95b39d98a538ef8aa3c9fb8373a
- SHA512 441f7c9c15ffc27fe8f6d301335102525e62c703726afe0f58e86f60f6cbd6cbd94613cf1d2d7272725b26e51b3030977fd758594ed1b90e8ed68b0bea939f72
- SSDEEP 24576:U2ctIvKqwpMKvT7QvYMy91tA2DP2crkmQNHElqKlRRaBll:JToMKvPQvOi8AmQNsrlLaJ
- TLSH T102459F0773E7C1E9DE7BC1F9C5614226EB31B8640B389ADB2590452EEF63AD04E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2040 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292930819969517" chrome.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "4" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 8c00310000000000e95ce47d110050524f4752417e310000740009000400efbe8158443be95ce47d2e0000004c0400000000010000000000000000004a000000000012757d00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" OpenWith.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 4544 PetSimBot.exe 4544 PetSimBot.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4544 PetSimBot.exe 4544 PetSimBot.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2460 OpenWith.exe 2460 OpenWith.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1900 wrote to memory of 4888 1900 chrome.exe 92 PID 1900 wrote to memory of 4076 1900 chrome.exe 93 PID 1900 wrote to memory of 4076 1900 chrome.exe 93 PID 1900 wrote to memory of 2040 1900 chrome.exe 94 PID 1900 wrote to memory of 5820 1900 chrome.exe 96 PID 1900 wrote to memory of 5820 1900 chrome.exe 96 PID 1900 wrote to memory of 3272 1900 chrome.exe 98 PID 1900 wrote to memory of 2148 1900 chrome.exe 97 PID 1900 wrote to memory of 3272 1900 chrome.exe 98 PID 1900 wrote to memory of 2148 1900 chrome.exe 97 PID 1900 wrote to memory of 3680 1900 chrome.exe 99 PID 1900 wrote to memory of 3680 1900 chrome.exe 99 PID 1900 wrote to memory of 2984 1900 chrome.exe 100 PID 1900 wrote to memory of 2984 1900 chrome.exe 100 PID 1900 wrote to memory of 2632 1900 chrome.exe 101 PID 1900 wrote to memory of 4480 1900 chrome.exe 102 PID 1900 wrote to memory of 4480 1900 chrome.exe 102 PID 1900 wrote to memory of 8 1900 chrome.exe 103 PID 1900 wrote to memory of 8 1900 chrome.exe 103 PID 1900 wrote to memory of 3444 1900 chrome.exe 107 PID 1900 wrote to memory of 1188 1900 chrome.exe 108 PID 1900 wrote to memory of 3444 1900 chrome.exe 107 PID 1900 wrote to memory of 1188 1900 chrome.exe 108 PID 1900 wrote to memory of 5544 1900 chrome.exe 109 PID 1900 wrote to memory of 5544 1900 chrome.exe 109 PID 1900 wrote to memory of 5900 1900 chrome.exe 110 PID 1900 wrote to memory of 5452 1900 chrome.exe 111 PID 1900 wrote to memory of 5900 1900 chrome.exe 110 PID 1900 wrote to memory of 5452 1900 chrome.exe 111 PID 1900 wrote to memory of 2036 1900 chrome.exe 112 PID 1900 wrote to memory of 2036 1900 chrome.exe 112 PID 1900 wrote to memory of 4560 1900 chrome.exe 113 PID 1900 wrote to memory of 4560 1900 chrome.exe 113 PID 1900 wrote to memory of 3844 1900 chrome.exe 114 PID 1900 wrote to memory of 3844 1900 chrome.exe 114 PID 1900 wrote to memory of 5860 1900 chrome.exe 115 PID 1900 wrote to memory of 5860 1900 chrome.exe 115 PID 1900 wrote to memory of 4140 1900 chrome.exe 116 PID 1900 wrote to memory of 2596 1900 chrome.exe 117 PID 1900 wrote to memory of 4140 1900 chrome.exe 116 PID 1900 wrote to memory of 2596 1900 chrome.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\PetSimBot.exe"C:\Users\Admin\AppData\Local\Temp\PetSimBot.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4544
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd34fac728,0x7ffd34fac734,0x7ffd34fac7402⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,13020380552341754968,12697851566899569328,262144 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,18350869966113256812,13258735047879453450,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:112⤵
- System Time Discovery
PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,202069395241752052,4549972233567784221,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:132⤵PID:5820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14897695122440669770,7511628703427319456,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,13078400672693223441,1723879666014962008,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,18343119693813053329,14013710199364718394,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,1384936887556325624,2732709521803441971,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:142⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,14782755928740271838,8813394201901555649,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:142⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,2777127526210126099,14719641159257259786,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,11139861048454973234,14022869267250729169,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5684,i,3021803445437114874,17865101242671258284,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5776,i,13863398996355335904,15403659187169673287,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5552,i,13758018957278977288,12826862783598745577,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:5544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5720,i,14627497878600147834,4723309266466826404,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:5900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6076,i,14254463150721868692,4581677422294801161,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5672,i,17473280018062291812,2800485843077937028,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,1737596513404187124,16321880859230571936,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:142⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,14525334603438581591,4524752698139262693,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:142⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,14396825994664751832,10133157970987147908,524288 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:142⤵PID:5860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5760,i,14553305876418000697,3469502454143331466,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:92⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6120,i,7017650763671874036,12943732124389450117,2097152 --field-trial-handle=1420,i,17531161075795499820,13668587409406815956,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:12⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:3380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 862e013a04cdd9fa536107bd3b72f58a792f0d1bbe4a1763e751c79efaa03880
- MD5 918b76024c9250f8c40f26389d1ad348
- SHA1 ac20796db57e9cfdad29b942b0f05f035c3f4fd6
- SHA512 4a3f15b3f30cbbe92b30111ffd3a5ccd0b7244eeee9da173a0c642e5f13a25f1ee1d62d989c521061320b4f4b188125dac7aa5d2edc2e04ef2ee62f9d0696f4d
- SSDEEP 192:MRvTabxv7pAPRp2o9XxHsb+WNnRf0Mc23eFoVyIsnAUge:MRvTShAXjfwN012Ze
- TLSH T18E32972EBE10693B6DCBC229FA667793D7F6102161D52E80E7FC9A2C15DB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
- MD5 17b14bf97159ca9e7782c9d7e031bfcd
- SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
- SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
- SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
- TLSH T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 724b66dd5355cd5201422a6445a73f42d49835b49b89bbb2dab83a6d1cdb8c9e
- MD5 fb7b467a95534a23aaebe2ccbbc65981
- SHA1 85e9ca81236e025e681e2edf58cca7d06b8172f0
- SHA512 9bba509131e7e94a5eaa24a20da86c812b948cac1e7a521d3f8ed27d357971a833bbc46cd9acf7e78cb655dce960ca87aba256c9d6577b7efd43188e4c604ea9
- SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok55mDoB6nGyvn0b4T85ybJv4a:xC0ITo+TQ0InDUDycPPb4T85ybl
- TLSH T12DA10736A0284C774076D44AB1622A53CEB9706BE9A2AFD0EAE90E0D15F70E81341A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 125KB
- SHA256 f0e050b568a65004d821714007cc5e9edd0290fae7148a545c53354c5efd4fa3
- MD5 443d7fa5e20da1955acfbd593debdb26
- SHA1 517ba33bad3807f958bdfb237d99d285910f8a00
- SHA512 089392b947db7c413d219d4c9d08b8426c637b34ee4f32caf304d2567be59309734cfeb684e98db9f79bf74f035afe85f2a4ad18c99a667262a871368cdcaeec
- SSDEEP 1536:Z8MxjV7cqNB3jVVhUPPEp/DtzHpoqDqZ/QjYx97ork0QCwutK3oKIDe5+gTKNYHe:zlcsjV/r5lUZF6rk0QCs3vI68Ncl1NQ
- TLSH T12EC31365444D2CE3568B8259B236345A727257201CEED3F5FC981CBB5AF18CC17D0AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1900_1099391066\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH