Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 17:44
Behavioral task
behavioral1
Sample
main.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
main.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target main.pyc
- Size 9KB
- Sample260810-wbbemathnd
- SHA256 d7d4cd131519141f7f8d5382bd56d020a91d71eed9fd17ce0dbb0a880c63b17c
- MD5 c646ab026581c5be3d4b77fe44cbb53e
- SHA1 3670d413c2a597e75da1347d64961de55cc00196
- SHA512 1ac7b34abb8090f5605d5a2e8b31dabc2b4c97d4c76f0af4770cef0d62edb279631bfc9abe79daed5b78c5e5a4bff96429700613d7813877d10e05dd840c5e26
- SSDEEP 192:I+7iwbshBhCiOoU4+2W7jEhmP1pEsSqK+x:DpUzCRo7+2WvEwTEsiO
- TLSH T1C512A1457BE7C477F9E2F3F04876671BB322D6B07282D3036AA744B41D4A2609D990DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 312 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3096 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308574769511945" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000ae5c460212004170704461746100400009000400efbeae5c46020a5d908d2e0000004ee10100000001000000000000000000000000000000f26454004100700070004400610074006100000016000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{9C2C31E3-85E3-400A-BF29-92534194C1FB} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ae5c46021100557365727300640009000400efbe874f77480a5d908d2e000000c70500000000010000000000000000003a00000000001f78670055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ae5c8b0d100041646d696e003c0009000400efbeae5c46020a5d908d2e00000043e10100000001000000000000000000000000000000feb4d900410064006d0069006e00000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000ae5cd40410004c6f63616c003c0009000400efbeae5c46020a5d908d2e00000061e101000000010000000000000000000000000000002b6fff004c006f00630061006c00000014000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000e141ec2537e3dc01026a092f43e3dc01095db4edef28dd0114000000 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 5664 chrome.exe 5664 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe Token: SeShutdownPrivilege 4028 chrome.exe Token: SeCreatePagefilePrivilege 4028 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe 4028 chrome.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4024 OpenWith.exe 312 chrome.exe 312 chrome.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4028 wrote to memory of 1400 4028 chrome.exe 95 PID 4028 wrote to memory of 3896 4028 chrome.exe 99 PID 4028 wrote to memory of 3096 4028 chrome.exe 98 PID 4028 wrote to memory of 3896 4028 chrome.exe 99 PID 4028 wrote to memory of 4232 4028 chrome.exe 101 PID 4028 wrote to memory of 4232 4028 chrome.exe 101 PID 4028 wrote to memory of 3524 4028 chrome.exe 102 PID 4028 wrote to memory of 3524 4028 chrome.exe 102 PID 4028 wrote to memory of 1188 4028 chrome.exe 103 PID 4028 wrote to memory of 1188 4028 chrome.exe 103 PID 4028 wrote to memory of 900 4028 chrome.exe 104 PID 4028 wrote to memory of 900 4028 chrome.exe 104 PID 4028 wrote to memory of 2660 4028 chrome.exe 105 PID 4028 wrote to memory of 2660 4028 chrome.exe 105 PID 4028 wrote to memory of 1132 4028 chrome.exe 106 PID 4028 wrote to memory of 3012 4028 chrome.exe 109 PID 4028 wrote to memory of 3012 4028 chrome.exe 109 PID 4028 wrote to memory of 2992 4028 chrome.exe 110 PID 4028 wrote to memory of 2992 4028 chrome.exe 110 PID 4028 wrote to memory of 4444 4028 chrome.exe 111 PID 4028 wrote to memory of 4444 4028 chrome.exe 111 PID 4028 wrote to memory of 1188 4028 chrome.exe 115 PID 4028 wrote to memory of 5016 4028 chrome.exe 114 PID 4028 wrote to memory of 5016 4028 chrome.exe 114 PID 4028 wrote to memory of 312 4028 chrome.exe 116 PID 4028 wrote to memory of 5492 4028 chrome.exe 123 PID 4028 wrote to memory of 5500 4028 chrome.exe 124 PID 4028 wrote to memory of 5508 4028 chrome.exe 125 PID 4028 wrote to memory of 5664 4028 chrome.exe 133
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:312
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4024
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xd4,0x124,0x7ffae91dc728,0x7ffae91dc734,0x7ffae91dc7402⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1808,i,7132779486445674811,7422907091397244529,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:32⤵
- System Time Discovery
PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,2321085643803311383,15073996212631152551,262144 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,665238649922602095,8740627767870670520,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:82⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,5559453586804503902,11234147934709936746,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,4780388441312294975,8422915090532185579,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,15802104679342734617,8513304016067133596,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:22⤵PID:900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,1802575279836678622,13474159243908060576,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,10057315505842536024,1061615953247840043,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:82⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,12019004294048456650,4667266017488452019,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4632,i,14425020908583604129,18373082199047035914,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4896,i,4909506080158089775,770955406573887092,2097152 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,17432399428701532236,4949237076787601083,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3652 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,4432529882921803606,4240173535204376412,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:82⤵
- Modifies registry class
PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,13297693955354641384,11425407662293257261,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,2907884367319461167,1726254999062294222,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:82⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,17719718061085871947,4969540349809490532,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6608 /prefetch:82⤵PID:5500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,15487743762846632740,10781622528589620702,524288 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6648 /prefetch:82⤵PID:5508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6720,i,11872234807710797779,13900092200286307481,262144 --field-trial-handle=2064,i,18270488437279848937,6699778702662889105,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6732 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5664
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7b8f8a85d08ed22e1de34e398db2abb32d9687f9d5e7520a6399608d683766f5
- MD5 c7523397192bcc8dd4c9a7d77198a272
- SHA1 de350476e88b3ec089ec5c0f2ae5b4cb6e7e06a1
- SHA512 cd6f7eefb5783f4cd87ca92e8b5747ad78d98399ccf225cc709eb2f458fc8fe742d063ad32271cca88d98f8a6d0498b57bdd9f3e38ac4e7d5311cc1e5465adbe
- TLSH T158E02B65C962EC7714FD0B28B0505742DB54139B2A408D4BBE3D901C8FB16364986C2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 2945430c6b174b9189d1c279bd897ad15a3b458c6823e31a5d78d02a0b795c7b
- MD5 e1f4f6fc8edf35b91ac6f5dd4bc957a5
- SHA1 0abf128d07164a1b2fea388e67c584c6e7a24337
- SHA512 3526e29adb446373cb810832647f78280aeddf03080c6261f4262cad7d80b6b54b72d6688dd8060e231e187481629e0f9bf97e746c8393b0153830b82ea3f479
- TLSH T143E05ED0148097D2DBB8767824D06C813173292F21AB5B5296398DF83897BF0C842A50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 baf3d89525b02a81f35c4a51e3f28dd1717d49196e6d435f687361e8a35a78d7
- MD5 3a193f9985f80f7c81c6d49f340ba370
- SHA1 b1ff6c1cbd01f89e51f659e3d7b96e3e5e6e5e8a
- SHA512 a8120593c5d6041e452509891c3a1750726a8ec30c5b8164e300c0c01731c72fcb83d277353bd1d5375c1e1b918b28917aa1f5e463caff419b395d44562312d2
- TLSH T1E6D012C05084D1D2DBB8A175209128803577191E65DE574351715EB47457BF1D552345
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 6243fd8dc32e1ea91e00bd7386ec487603d2ec7199b11db6ae1152041330313d
- MD5 81eb1db4e0ac7fa5ed3c77de76ca1fe0
- SHA1 d14a5c129335c55b49adc674bdd7fee5e851432e
- SHA512 0a97deedf671d5a2979a7e63869ec386ae8a85df997fd036ceecf3ae3285f7ea4e1b6a7b4f51bbdf121d01514ef58b5b7b642f563339064f8cbf13d2271d2aa6
- SSDEEP 192:DyQempgQKaIQ4a/c7AGl7zrg0PpOBJ42g/:DyQempgQKaIQ4a/c7AGl7zrg0PpOBJ4t
- TLSH T1C7D1ADF3C3E89A2E8C1192F5BA246E1BCD290D14432C7D66C9D5AE9F63E3871D34154E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 d8aa3860f0e931162301e9827502deaa7cb5d25839926b76789c9a4920ebf739
- MD5 108b277e9d646558c4619ad59d46acf5
- SHA1 992fab1988bdaa8786f6668f2e5c11b3cc3accfd
- SHA512 313dd8440254dd0580b62788e72f18f5d1d8b94a0b9f8e64979b01db5abe8d1e8ed6d55cb44209db1c796fcf71bfb6101e1e73c4f7060d44763ba1890c767d7d
- SSDEEP 192:fRA5vMDkDOBgN3uv7WpAPRp2dqll9+Hsb+WNn9K4pu2L2WUaO5rPVyIsnAUgraJ:fRA5vGmKSUXV8wED2RUaoe
- TLSH T1B852C629BA10697BACDED219FD617723D3F6102224D12E84EAFCCA2C15D76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 cc2d9dd37270428bffab141e8f4bbdb46b6eac34585ea3929d5ee92d5ae6e401
- MD5 12dc8d38ff5873fc80c25025f4097935
- SHA1 62fefe240c65b37afad27e31bdffc8a72b7d9f94
- SHA512 48f52d750d5f24b830a2a316433661b098091eeb393b12d9068fa3d2bd720211e2d1854f9bb353c09e692c000808beeb98d6b16516612cd43418573dacd8a957
- SSDEEP 192:fRA5vMDkDOBgN3Cv7Wp7PRpjdqll9+Hsb+WNn9K4pu252WUaO5r5VyIsnAUgraJ:fRA5vGmOSZXQ8wED23Ua8e
- TLSH T16C52C629BA106D3BACDFD219F9557B23D3F5102224D12E84EAFCCA2C15E76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 b4df219e046b45aa40b06271168897469a6621788f38b32e815ddeafe9e4f4ec
- MD5 39da41cb0b2a26de16e3a8dd16e5696f
- SHA1 6d3ebc57191c0f0909fd8fd2223b0e8fe69608a3
- SHA512 33c6d5e09715e5bbdbdb76f0630d1fdcd90a8d0f9b21fe83f379f4110df858d501240a9058d56c561147ee87299991a982510678c9c2663510af2a5c29c077fa
- SSDEEP 192:fRA5vMDkDOBgN31v7WpAPRp2dqll9+Hsb+WNn9K4pu2a2WUaO5rEVyIsnAUgtaJ:fRA5vGmFSUXV8wED26Ua18
- TLSH T17E52C629BA50693B6CDFC229FD657723D7F6102224D52E84EAFCCA2C15D76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9cdd5da6e8547cb5e8ccd3f0b9f09aecb65b70c4d64721bb0acb0aa59437be17
- MD5 dae3f0d18993441e05bddbfcb008f1c2
- SHA1 0fa2ba92463ced7cdfa0e97f3af7c77f4389f08e
- SHA512 eeff262a77b0ef852f56c0e82a5ce8d2a2ce8d6e93d00cabc277099a9a85d5b03f62a464830560ed51b4b2ea37c60d0d99216f08cbd7f5113c5e471760aa5079
- SSDEEP 192:fRA5/OGN31v7WpAPRp2dqll9+Hsb+WNn9K4pu2a2WUaO5ryVyIsnAUgtaJ:fRA59FSUXV8wED26UaR8
- TLSH T12A42C52DBA10693B6CDFD229FD517763D7FA102224D52E84EAFC8A2C05D76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
- MD5 3db4d2ed90c53237037f403d9b6c10cf
- SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
- SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
- SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
- TLSH T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d4e98f3322b29aed133e901d2593c51c865c5c4ecba3c5be8c6dfa0e2ecdd59d
- MD5 32aa4d014fb6ca34e28de7e2c575b3f1
- SHA1 217eb2531c351010e4f07c9a90fb60a93db01c71
- SHA512 2dbe561b66b1a627b99b0b84d4a0b6dcf2a1dd2dab69a7146d247d6caf8a699d884697ff134ffb833cc5af14d44f202c2cb7641ccfcd11a3b8d3adb92802cfb1
- TLSH T16CB0124184019542C04202B411521888B1246F11D70E5701A3E06966D825161C029093
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd7f.TMP
- Size 96B
- SHA256 d7e186e2bc9da09b1e2a33e94fdd1767cd731b4dd1172fc989ee9f92ad02a707
- MD5 b3e237ed06ac57efbd5c4891af4c899a
- SHA1 6bf408d368312316c1f322ba988ca41f56ddb6d9
- SHA512 d347452112c8cb5339be7cc204f7db09cdb845f84915d6df22f32135bfa456a5422b9ebd27bacffb1e1441f4bd57f6855952ba33a349db7ad63d483e209c4a7f
- TLSH T185B02200C0022323C03223B0208880CC3020CFB0C2030302B2F02A2AFC283300A2A020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 78B
- SHA256 d82dac03c5b49330ad09c959b42cb5123a3e521ddde5befc624efd966d760037
- MD5 fcb72bb63dc7fd744036aef301a3a465
- SHA1 5f18eb2cb4c968f9433b0dd9ef57bdc41f1b5f9d
- SHA512 dd1a9af69f3b5ed9aa3720dfa58b527b1f486bd2a3c67d7070567e6b4ee2abe86d1df63c6d877f5e6b7834a45412611bb725ae9d3cf8831cd6c835ca8236114f
- TLSH T14DA002FB1808848A1F70BAF82479B71DE00B828D8CE5DEF0C408B0E22179A3200039A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 159B
- SHA256 b05a64ad739f20a2d1a0f4cd7f4c8e986a608993ac84e84131e0c9ad77675c5b
- MD5 bb026869bae52e0ec9d34286eedddadf
- SHA1 3e0e6f77f8ce06650de1c426929bacac2183d182
- SHA512 9879985375308d59cf0d17e3877957a4409b195b774f39c4908578d703a28eab5fa57ffbec1285ebfea2133a4fda30e60969363682458537a93b6386f1e065c3
- TLSH T190C08C97241006461FB177E05074774DC1078D4E8CC0CDB8D40574D230357124842522
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 152B
- SHA256 2c2e24a00195cc01c6ede3a774316689d9c343077ad6649e4d9f8a5aa6ffd571
- MD5 b2afa30f90a3a4c86ceea86aeb7bce94
- SHA1 add1937ef48bb2e666606ad6395b32b9192cd0bd
- SHA512 d035046b16152d1a0a117b36fbe753ea2e4e17d7daee9c4a7ec209453a7a1ed140219034e9cab73fe03036e379fcaaf4edc225571598da22816c19926edf6ff5
- TLSH T1B0C02BDB3800464A0FB0BBE41074770DC107834DCCD0CDFCD40464D220357124803533
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5880e3.TMP
- Size 162B
- SHA256 feee6b371c09653222e446bbadec8f8e8f2030491aaf519d13cec57cd816425c
- MD5 fbd2bc01d7fa8a30fe2b2fec4af8c474
- SHA1 2709dbba73e1ada6306eeea1fcb9f24d98019b8e
- SHA512 e3e98b551c18fd2f2c37c82d12db2e72a14f9711258b4eadb530519750b592a7665e9867a942b93e3fe009cf264e1ec9ed2349d5f0e452bcde337c3c5bf45089
- TLSH T1BFC02BEB813540051730B6F42C35B30CD00B9C4D9CC2FEE0C405F8E220BEB22C027564
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 939b4ad10f5c896862d5c8fe15d8ec27394fc03aea527c520c39a83ee487e56c
- MD5 507878ae31c055449133fc293942c5e3
- SHA1 57e828b0eba9ad8ce2864798ec749fd5488480bc
- SHA512 9065f12a59f45a487657473e193b8902dccfafd518b4a2b51313d9df3b67cbd2d29f8af54c001eb374c26e21e5fd76b6f888cabbd818df2ff1866d158d0a01d6
- SSDEEP 6144:MQLtjTQK+DvNtD0jks0FhLoqt6qZ/ZLW3ExX:9tjTQKivNtWkJFhvt6qZ/piQX
- TLSH T103341273EFE1AE334F81872079531F6726FB48AAC214A35A19993AC71C4EA12FD46058
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 7a5b4ab1f3fb8ae1bb77086839ee9982693ed903785c05dabf862b53954fcdf1
- MD5 a25f24f487c727fc1380060ee35ab3b8
- SHA1 fb531f14ae6982be2529bcb49a11565e96dd9b8c
- SHA512 620fd52c5ef1deb71420169a59c9d07e3eefd972b17f983b4aa0632feb823b6528fc93dfa91e00c266275a2384815767d1ce7d3bf61d71ae2a568bb22d83eff7
- SSDEEP 6144:dDLtjTQK+DvNtD0jks0FhLoqt6qZ/ZLW3ExX:htjTQKivNtWkJFhvt6qZ/piQX
- TLSH T1C03422B2EFE5BF374F82833079531F6722FB48A5C11493971A9D3AC75C4AA23B946058
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 25175010aa803e32dfedb30fca1b695e5a81ef1dc1605b70bbae54bb49789295
- MD5 8300ab984ca4f58fc6f9e325269f7ee6
- SHA1 a10a3aa87b6731c92c836ec6a76d9396f61e598c
- SHA512 4a7cac539e33a2f21e67f038eeab530ecbbb28a7ba167b243d7f0a40afd308687a387677b14d14b56a96de9f8a8eee01d5eb6683e3df2363c1c80c758e6d9f90
- SSDEEP 1536:6e/AyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbJ:9/Cqfd7NtZL8cHQRZEQ6SpsS
- TLSH T1EFC30237ABC25F339E83CB74B5130FD797B644A99034D301AAAD3BFB6883591648249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 185da75ddf5654897c7a6213828f03d65ada35febba8a344b33135d3b51b592f
- MD5 20b952be7e098d3991eed09fd5d725aa
- SHA1 0326ff6821e581b0ea1daa5e11429a2e74895a4c
- SHA512 5818ba71cfa8dba0a41a921a70ca870428d53324f8a44dd577ff9389fd2d9656500742a7b8cd6c171ad55e4081f4409382c9ac6a09c17f8265e5eecd6805afdc
- SSDEEP 1536:bjLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:9qfd7NtZL8cHQRZEQ6Sps3
- TLSH T122C30237ABC21F339D96CF64B9130FD6A7B644A99030D301AAAD37FB7C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 ca05296b517004ea9159c7682b4c87af0bd6e1ec790d58c4536cfbaa60453dda
- MD5 8f7e2eddba4942b3368008665c96d59c
- SHA1 edeb1e9480f3e089cba21cac29e711ad3ab58e42
- SHA512 1c4b85c58f58e5a069f50260d95d58466643bf42390678a2e0f7bb30d4436bff3d5055519b6f31f6759b975138a224444a6fc4e850f21bc2233091d6b3ebae90
- SSDEEP 6144:iDLtjTQK+DvNtD0jks0FhLoqt6qZ/ZLW3ExX:KtjTQKivNtWkJFhvt6qZ/piQX
- TLSH T1703422B2EFE5BF374F82833079531F6722FB48A5C11493971A9D3AC75C4AA23B946058
- MD5 SHA1 SHA512 SSDEEP TLSH