Analysis
- user interaction
yes - max time kernel
104s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target [tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent
- Size 62KB
- Sample260805-bpcvdsbe66
- SHA256 c6de59e191d96b92da72ea367440d8414a908596a2ff5ec184f935728cad7665
- MD5 ba57ff507066cc7851cd1af8d615f14a
- SHA1 30e03524b2e91d90f4fa2e1bce6699a3e8ec837f
- SHA512 09afa867caa78aeb8f4cacf11714a96ccbb6a8006fa0dd0e103da7d1658399395be3cabfceacc1dec55bd9f3f4c2a60634591e55467d241170e70bd737f284de
- SSDEEP 1536:HP2SqJBMTIbNIDZU1dFlDXd3aV2gBO3LACW:v9qXMT7Z6zlDXFaV2gWe
- TLSH T14B53020EF1336E457B4A2B5464378D125817B0C4FDBA2C65CA9C97B405B3BAAFADC148
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2380 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2544 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303664323424091" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5400310000000000ad5c04a910004368726f6d6500003e0009000400efbead5c01a9ad5c04a92e000000b9340200000001000000000000000000000000000000871216014300680072006f006d006500000016000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\chrome.exe OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 6000310000000000ad5c04a910004150504c49437e310000480009000400efbead5c04a9ad5c04a92e000000dd350200000001000000000000000000000000000000599d1f014100700070006c00690063006100740069006f006e00000018000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\torrent_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications\chrome.exe\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\torrent_auto_file\shell\open\command\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" \"%1\"" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\芓쳤ᜀ耀鵰⋌ƭ OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Applications OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ᚸ⋀ƭ\ = "torrent_auto_file" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\⋀ƭ\ = "torrent_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\芓쳤ᜀ耀鵰⋌ƭ\ = "torrent_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\芑쳦蠀夐翸 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\芑쳦蠀夐翸\ = "torrent_auto_file" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\\ = "torrent_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\⋀ƭ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5400310000000000ad5c01a91000476f6f676c6500003e0009000400efbead5c01a9ad5c04a92e000000b8340200000001000000000000000000000000000000c2f5e30047006f006f0067006c006500000016000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3932 OpenWith.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe Token: SeShutdownPrivilege 2960 chrome.exe Token: SeCreatePagefilePrivilege 2960 chrome.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe 2960 chrome.exe - Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 3932 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe 4384 OpenWith.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3932 wrote to memory of 2960 3932 OpenWith.exe 96 PID 2960 wrote to memory of 4512 2960 chrome.exe 98 PID 2960 wrote to memory of 2544 2960 chrome.exe 99 PID 2960 wrote to memory of 1556 2960 chrome.exe 100 PID 2960 wrote to memory of 1556 2960 chrome.exe 100 PID 2960 wrote to memory of 3916 2960 chrome.exe 102 PID 2960 wrote to memory of 3916 2960 chrome.exe 102 PID 2960 wrote to memory of 1668 2960 chrome.exe 103 PID 2960 wrote to memory of 1668 2960 chrome.exe 103 PID 2960 wrote to memory of 3732 2960 chrome.exe 104 PID 2960 wrote to memory of 3732 2960 chrome.exe 104 PID 2960 wrote to memory of 3348 2960 chrome.exe 105 PID 2960 wrote to memory of 1168 2960 chrome.exe 106 PID 4384 wrote to memory of 4772 4384 OpenWith.exe 109 PID 4772 wrote to memory of 3192 4772 chrome.exe 110 PID 2960 wrote to memory of 2656 2960 chrome.exe 111 PID 2960 wrote to memory of 2656 2960 chrome.exe 111 PID 2960 wrote to memory of 3896 2960 chrome.exe 113 PID 2960 wrote to memory of 4336 2960 chrome.exe 114 PID 2960 wrote to memory of 1584 2960 chrome.exe 115 PID 4172 wrote to memory of 2164 4172 chrome.exe 118 PID 2960 wrote to memory of 4156 2960 chrome.exe 119 PID 2960 wrote to memory of 4156 2960 chrome.exe 119 PID 2308 wrote to memory of 2300 2308 chrome.exe 121 PID 2960 wrote to memory of 2712 2960 chrome.exe 122 PID 2960 wrote to memory of 2712 2960 chrome.exe 122
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent"1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2380
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\AppData\Local\Temp\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83cccc728,0x7ff83cccc734,0x7ff83cccc7403⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,17825737155726323747,3057864883188868921,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:33⤵
- System Time Discovery
PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2523732777867023951,1945850831515214363,262144 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:23⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,2764105702372649383,6681315367594651334,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:83⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,5659582104106690323,12642502545944039516,2097152 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,1854615712650181656,10600077114623273184,2097152 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,12083053366020305702,15159040523422466050,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5128 /prefetch:83⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,9151113067319149432,14779234077807005998,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:83⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,14030748121296437924,15288081757944430521,2097152 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:13⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,2831735378995485329,6251771308456480110,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:83⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,5793933060846090608,14588185378640567704,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:83⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,5022886331764412107,5527655737341232105,524288 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:83⤵PID:1584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5972,i,17766718244918363103,14314180576224676657,2097152 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5980 /prefetch:13⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5660,i,6590078014031573232,4289720141096587847,2097152 --field-trial-handle=2004,i,1549487038126734546,6335967026967851380,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:13⤵PID:2712
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2148
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent"2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83cccc728,0x7ff83cccc734,0x7ff83cccc7403⤵PID:3192
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3884
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent"1⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xc0,0x104,0x7ff83cccc728,0x7ff83cccc734,0x7ff83cccc7402⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xd8,0xd4,0x100,0xe0,0x104,0x7ff83cccc728,0x7ff83cccc734,0x7ff83cccc7402⤵PID:2300
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
- MD5 9e8a968ddefd4d013e51d21d82cf1104
- SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
- SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 9967cf2de62f4c2be471cebcca87b7ff5e33fa91b8bb951bd104092853af145a
- MD5 59279291dcbdeb9b9ca12c72164efdca
- SHA1 76a9f0b44d4457ea7b8c6b79b57d383ceadac09a
- SHA512 b7c6c9fa26f96269711a7c312a243302b11822e05d5edadab12a2996470dfe4d249b2894c27d3aa89faa4a7ff6fffec71578168f51ee9146ccb15010c567ba23
- TLSH T1B9E02BAAD931AC2758FD472D60900B46E64023573F90C95F363C8109CFB8A370149C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 74efb1df938d03aa59be7f7763c7d8b62cd716058d342de54dd524b950b773da
- MD5 8bd9a7ddbfcca8c5cb299567ac34c63e
- SHA1 068e4eb62b1df2626e61c4f4a2d4f6d2b9246a0e
- SHA512 4b4677a13b0664e56638208a34e8178eda2750f759e7ed869feae5e12f995ec22a1cd7f4f7c3df5f82fbf179117b4c635fcaf80ecb1720574d5e7f7e4cd29e6e
- SSDEEP 3:MsEllllkEthXllkl2zE/lt5Na:/M/xT02z
- TLSH T1334402046F800446C5006138445283542371FC50061A5753686714329C956500C00000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 0917d32446790452f22dc98bfa2c5ffb3a0fad719d1016cfdcf12612e9faa38d
- MD5 157bef04b1fd77cd4860180c42725e9a
- SHA1 7a87398991e4590dbe5d57ad5fa6a865c1a968d9
- SHA512 431ce0afa131bf9929081f4a72a7161d345ed4ce316dfd36a3291aac416cb26f88fe4958bd9be9e30a7bb06a4b0685c989f810d15af7f7c62ae57ce35ff6c5e4
- TLSH T153319CF793B4997E861196E4EA11AF1FCE790524031C3C7689D4AE2B43F2972D10479F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 fdeae2cdaba375b2f825f01ddb25d62a7d0b9b6a263f6b146d8d30183847b58b
- MD5 f9f4ad14f95199f032afb2ee2d43d513
- SHA1 1b0ac9cbda8d4d2eeb9e93d2d1b29b71e8da9c9b
- SHA512 007e330df9f57116ed502d00b8a9f39e0630de02108e1ec63afa282731f750bab360589a12edce7ec7aee21a6b7cf2f1b2e087b72639275d78c29f977958d098
- TLSH T1C1F0247BA66F7427127D95AA1D00B80E14B5A835568458F0CB6B816ED0451E32F02443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 e44fa89ede02991cdee2193b5029579145fe12fbea4078ff9f74ca7f9464dc07
- MD5 c2fe7f5c852fee3f864553daac5f8f1a
- SHA1 0565417de5e7f1567fd351b0961311f6a6ccf315
- SHA512 616ae15ff7d1844d4484e35ee2041c56d5fe7a8ed6a20207aba2d1e6771b774758d85949c4156c59fecc8f6ef0d709b20d5874aa7ba9560538f9fab60d83cc31
- SSDEEP 192:/R56xoGv78pAPRp209DHsb+WNncorPKtc21wzSQkwrahtVyIsnAUgtaJ:/R56Wy4UXD5wc8PKW2aSQLaV8
- TLSH T1E242E62EBD14293B6CDBD21AF9657713D7F6102261D42E94EAFC892C14EB5CC322B11B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 613d7368a05889e54963ab7d43f921e0efc0cca85456157df8bd4f5bd8569e7e
- MD5 447f9e069e5641037eb1395988db2952
- SHA1 15516d71a315158b1e614d0ed51bf51bf9bd05c0
- SHA512 607bde48d14b14cf4044eb9474da16038356b76c658579e8ad0db20ab2561bd3f16597dd6dc2612b833db815d60fab968911e7eaf94ae09f60fce7a11cc38cc7
- SSDEEP 192:/R56xoGv78pLPRpz09DHsb+WNncorPKkc21wzSQkwrautVyIsnAUgraJ:/R56Wy4tXo5wc8PKp2aSQLaoe
- TLSH T15942D72EBD102D3B6CDBD21AF9557B53D7F6202261942E94E6FC8A2C14EB5CC322711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 58cde8a211d540493d26e611243664103b573feaf378b72a5ddabece3ac8baf8
- MD5 6fec81bbd10faaa0c8ed4d45eb5d3b22
- SHA1 67e9f8f55219616c58ac5287485a7521e8d0d87b
- SHA512 bb5b11efd7b06d7a0dd04b7eb9fd9e150ab118f516feb0bb39aa15a29e35a3e56d66c64bb7c9f611b27dc358eefc050fdd17ab9f5770a7889868b1f1a1e3b470
- SSDEEP 6144:v1dGvs6nlKnw+V11xQB5H3w0+F1m7Rkm1tYpBeh2BAo4:9dWs6lKnw+L4289oBGcAo4
- TLSH T1C734123A9D75AE7318FEDB29744F260E1EF206EBD528F992D9C87B0933DA5041C46170
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 6c648d7fadcf0d4606e2aa85e29ca08184f5cb7974f1dd1c67dc8f8ba241b142
- MD5 719e591018709a29eab5a36819bf55d5
- SHA1 09184a8bc638f7211d8facc69d873a1c422c40b2
- SHA512 8482a2ac74ed3fc0a191beb3143435603ac3e530789d5235a41f3ca5a37bd1ab9171ae79104b0bb454a0946ed7264bbb766079146db5bee4997abfe74a74e9c6
- SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:rm7Rkm1tYpBeh2BAoO
- TLSH T105C3123B5D65E9375D79A70EB48E0B1E1EF24DA6C930DE4288D86B0437FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 24fd7f8138f10f678ef81925a57dbec786fe041ed5da59b43f4cf065f44dcd6c
- MD5 9be6946706e4ecedcb317f5cba32f62b
- SHA1 0d741e343267502f0370279befb945c7b50afc41
- SHA512 112b19c28db7073d6f2223a171a226caaff73a02c237b67c76cbcd3b2155bc4870a0f5daedfb298e46a5762ab93977e7317d924500c1550653873781d627efff
- SSDEEP 3072:tMGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:t/m7Rkm1tYpBeh2BAor
- TLSH T115C3123B6D65EC375DB9BB1AB04E0A1F1DF25DA6C920DE52C8D86B0423E97CC1A48934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 309KB
- SHA256 843e5ff674f1736f23c229fd0f0a1801860637c04b62ddfcb054f3e88f18fde1
- MD5 508006241922ed2e30c57337167902ac
- SHA1 b1492892caa7615161a1e9f42b4824c42307b430
- SHA512 b03c68ae0f3bca0f3cf9a4bc254846f6af5cd1564b0539ab230ae08ad90202cd11d37ce6d01fad7405fe2fdbab2f9962f291fa6af7c437d9d670957518e12ffa
- SSDEEP 6144:JTYdD3rMo1mGvs6nlKnw+V11xQB5H3w0+F1m7Rkm1tYpBeh2BAo4:aD3QwmWs6lKnw+L4289oBGcAo4
- TLSH T1E164123A6E721D372DFDD329B01B3B0E1AF54A9AD51CFC9AD9C43B4632DD6481846270
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 a183acb14b5b90ef43c83a99e29bf572edc518e7d5e90d368444985d8b29d4ae
- MD5 3e5f3d6f22b0edaac34da743d916a247
- SHA1 ae8baac5931ea4a1d5e9e64ee5a411865d98a691
- SHA512 89fce8f27cefd85dfbb1135607bfeab151136b4ff5cfd27b182daed8133331cdcb1892ea47b0017ccd11069ef67bd80b6729cdf36119d63e959ea2ea9bfbea04
- SSDEEP 6144:mrGvs6nlKnw+V11xQB5H3w0+F1m7Rkm1tYpBeh2BAo4:mrWs6lKnw+L4289oBGcAo4
- TLSH T12E34133A9E76AE7318FED739744F2A0F2AF209EAD52CF9A2C9C57B0933D55441842170
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\[tracen] Movie Umamusume Pretty Derby - Beginning of a New Era [1080p].mkv.torrent
- Size 62KB
- SHA256 c6de59e191d96b92da72ea367440d8414a908596a2ff5ec184f935728cad7665
- MD5 ba57ff507066cc7851cd1af8d615f14a
- SHA1 30e03524b2e91d90f4fa2e1bce6699a3e8ec837f
- SHA512 09afa867caa78aeb8f4cacf11714a96ccbb6a8006fa0dd0e103da7d1658399395be3cabfceacc1dec55bd9f3f4c2a60634591e55467d241170e70bd737f284de
- SSDEEP 1536:HP2SqJBMTIbNIDZU1dFlDXd3aV2gBO3LACW:v9qXMT7Z6zlDXFaV2gWe
- TLSH T14B53020EF1336E457B4A2B5464378D125817B0C4FDBA2C65CA9C97B405B3BAAFADC148
- MD5 SHA1 SHA512 SSDEEP TLSH