Analysis
- user interaction
yes - max time kernel
82s - max time network
82s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 17:16
Behavioral task
behavioral1
Sample
cakelock.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
cakelock.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target cakelock.pyc
- Size 9KB
- Sample260812-vtflmacj4x
- SHA256 43c798b2d84237eb213bec69f90ee8276d228995ec48aa6a8c1a94c204fac0ab
- MD5 dcd7ec49e34c3fa9f7f82eb18b9a4f7c
- SHA1 ed2622ac1cf21318fdbd91292aad457caa6ad273
- SHA512 07b19bfb8d7fe89ebdd4264006759541b47d7666128299c32694fbc8126d1c05130487b1c89d042e69449eed501996c097a54892f0a546551606059d3180406c
- SSDEEP 96:CHBtJrLoAA+ACf1ehZ6dqFPqqKyiCJyqDAWjWL3y2DwJErwxO6QPLkuzszDz62zc:+y406dUKyTJyQAD+UTm2a77C6EBsXI
- TLSH T19012C7B0A4058E27FD51F279541F0300EBBAA39B21E9B7535887F16A0C4F6C5A93D5CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2956 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1752 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310286442626764" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000344a71fb19e3dc01dabb150a23e3dc018e7a026f7e2add0114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ad5c2da61100557365727300640009000400efbe874f77480c5d278a2e000000c70500000000010000000000000000003a0000000000cc84ce0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ad5cc8ae100041646d696e003c0009000400efbead5c2da60c5d278a2e00000053e1010000000100000000000000000000000000000026f8c800410064006d0069006e00000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000ad5c3aae10004c6f63616c003c0009000400efbead5c2da60c5d278a2e00000071e10100000001000000000000000000000000000000d2ecf6004c006f00630061006c00000014000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e003100000000000c5d2b8a100054656d7000003a0009000400efbead5c2da60c5d2b8a2e00000072e10100000001000000000000000000000000000000dd6abc00540065006d007000000014000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000ad5c2da612004170704461746100400009000400efbead5c2da60c5d278a2e0000005ee101000000010000000000000000000000000000002936c0004100700070004400610074006100000016000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{6B97AB22-D012-4F69-B931-5BD5A0099A9C} chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 448 OpenWith.exe 2872 chrome.exe 2872 chrome.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4024 wrote to memory of 1996 4024 chrome.exe 89 PID 4024 wrote to memory of 2484 4024 chrome.exe 90 PID 4024 wrote to memory of 2484 4024 chrome.exe 90 PID 4024 wrote to memory of 1752 4024 chrome.exe 91 PID 4024 wrote to memory of 2248 4024 chrome.exe 92 PID 4024 wrote to memory of 2248 4024 chrome.exe 92 PID 4024 wrote to memory of 4472 4024 chrome.exe 94 PID 4024 wrote to memory of 1324 4024 chrome.exe 95 PID 4024 wrote to memory of 4472 4024 chrome.exe 94 PID 4024 wrote to memory of 1324 4024 chrome.exe 95 PID 4024 wrote to memory of 208 4024 chrome.exe 96 PID 4024 wrote to memory of 208 4024 chrome.exe 96 PID 4024 wrote to memory of 992 4024 chrome.exe 97 PID 4024 wrote to memory of 992 4024 chrome.exe 97 PID 4024 wrote to memory of 3916 4024 chrome.exe 98 PID 4024 wrote to memory of 3916 4024 chrome.exe 98 PID 4024 wrote to memory of 2088 4024 chrome.exe 99 PID 4024 wrote to memory of 2088 4024 chrome.exe 99 PID 4024 wrote to memory of 1700 4024 chrome.exe 100 PID 4024 wrote to memory of 2032 4024 chrome.exe 101 PID 4024 wrote to memory of 2032 4024 chrome.exe 101 PID 4024 wrote to memory of 2872 4024 chrome.exe 102 PID 4024 wrote to memory of 3408 4024 chrome.exe 104 PID 4024 wrote to memory of 3456 4024 chrome.exe 108 PID 4024 wrote to memory of 2156 4024 chrome.exe 109 PID 4024 wrote to memory of 2536 4024 chrome.exe 110
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cakelock.pyc1⤵
- Executes a command shell one-liner
PID:2956
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bdacc728,0x7ff8bdacc734,0x7ff8bdacc7402⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,1819955339840616790,12259374705232059633,262144 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,4788663039177375009,9890992733226467360,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:32⤵
- System Time Discovery
PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5130559669980139404,2499321138710889783,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10148609961314737975,3909848107036624718,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,8786462062830563339,630689182440822556,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,14958464972596614907,78154560211423310,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:12⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,7841215353380390160,6059134189862836897,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4728,i,10446410682501914182,967971627664779895,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3456,i,15375538870802433597,1559401400425691522,2097152 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3660,i,13453945707962636568,15228468517772728441,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:82⤵
- Modifies registry class
PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5212,i,8717916562797878880,11806715392785982491,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,530169623742410508,7547116991696184537,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,5950719271633622158,1219805750939373919,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,2349953332732009134,8998388652763945648,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:82⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,3444271353078016904,18323758361089041134,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,16155719051012477968,13212343788350108110,524288 --field-trial-handle=1984,i,15268749133699253601,1063275480945044664,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7bbe50fb43c7237dcedf6486ab6fda91d558b4abef56c063fc5b0a74023c167e
- MD5 65d0525678819328dcb4082862641c23
- SHA1 202048db3d73ee916b2932d1d29c7946ab2267c6
- SHA512 5e8d158205976db6a1dddf8f87a0c2c700354c29e1e9ad5253df5c32a42c8233691e67e49bab8ea152990ea9730b22cea19efd4808224b93c4424f6cc557128e
- TLSH T19AE0E5AAD931B82718F9576860944B86DB4013572A40C94B3A3D8409CFB4A370559C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 9d667945ecd8208327e82ec403c0b38160d15623dd05d4c700895e630b13d391
- MD5 540a130a51794427198477ca13a4148d
- SHA1 427228b1addeaf21ece65e473eee4acce2204d4d
- SHA512 69f84a00d31f3da22824c0d4642d7f5b7fcbf90b9516bd514703f599a815ee5ea5ed7079c3a8cba4fe031efc367a70c2948827fe05f3f971a3b627bf06082c90
- TLSH T15FE02EF013E08B4EEBD0023274C2CD4174B2043BE133AE2387A04CF8ACAB3E00A0A423
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 69292a5ef462249f17c43f010ce7805a2e71bf388041c6b90a26bcc2287f2651
- MD5 c1dc1c3f15536967a5746cbc26f550dd
- SHA1 7d073f1ddfb0dc9ae30562dcea2610c8f30496f7
- SHA512 e43fb1f0738039b1278e65ca206f24cf827751bc0af81334d40f718d19f51cf67fada9bd91671bdfcc7e1313bc3a16c55b8415fc83538a542e5af84776dbdeb0
- SSDEEP 96:DuzGPQV1FEe7LPwpaIVSrr17Am6LpzrwJIWwEw4RaPQzUrwkgcKK:DuzuiIe7DwpaIVSrx7Am8pzrwJIWFw4q
- TLSH T136C19EF3C7E89A3ECC2152F47A246E1BCD290924532C3D66C9D6EE8BB3E2471D24154E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 1539a825d8f0e2d558fd70d301453adcc5538570c1c4226515e152162444dfa4
- MD5 ee9553dc2e2ceb8d01e645a514f4172e
- SHA1 052ac00e14e0ac7342395a899e7713c16fee6aaa
- SHA512 4506bb695c0c68d8e203ac177b419b3d019b08efe3ce0839043adfa376a842d04a167ad51d53fcc0765ef032a1f5a1bb5c7025b483ed14759569f2b4c4e4acc5
- SSDEEP 192:lRaox43v7GpAPRp2zlX9DHsb+WNnRW4if2qQk2IeMK5ctVyIsnAUgraJ:lRaomfiUXA5w412qp263e
- TLSH T10442A62EA910693B5CEBD21AFD667B53D7F2102261901E84EAFC892C15E76CC322751B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e120c6d45bf5965f057f481284debd12849253f4e34ecccbeb3456762267d783
- MD5 eec9097319e113f9d4e22d0b8719ec47
- SHA1 b1a9f90ff636864f910bad7fca7e5ad1ebfc9b24
- SHA512 e844cea89e9e69142ee46126b21e08434f027782cfbb087a494c0463473d4fb7a3b3aa84e63e912a93d73ef35be51e920542a57ed3d5a9f77e28a2b6ddb1dd61
- SSDEEP 192:lRaox4tv7GpAPRp2zlX9DHsb+WNnRW4if2fk2IeMK5ciVyIsnAUgtaJ:lRaomNiUXA5w412s2628
- TLSH T12E42C82EA910693B5CEBD21AFD667B53D7F6102161D01E84FAFC892C14E76CC322750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9ccfe0ec7a26f7cf39bc089412539198d5a86e37cec822b35f94aece5fe01f35
- MD5 c2faf56bd3b6f28a5d1801cc672169fd
- SHA1 eaf65b5f5deb22669e731464dad18c50c6777981
- SHA512 2b6efd27364655849c0d8e0a89be214c4075fe697de4aebb0b167df71331edacb065987c987c1639db0fbe4a5336f7e6fde3d1907439a43592db4fdbcd81d7fd
- SSDEEP 192:lRaox4av7GpAPRp2zlX9DHsb+WNnRW4if2fk2IeMK5ciVyIsnAUgtaJ:lRaom2iUXA5w412s2628
- TLSH T18442B82EA910693B5CEBD21AFD667B53D7F6102261D01E84FAFC892C15E76CC322750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 77e9aae742c6501226bc999a1bd4bd1a0dab4af0593cbc9c4eae474738b67b60
- MD5 5154281f09da658c0060b01dc8436c6b
- SHA1 99b9c0a3fb0a4a1b78f8c7634c06bda80a9e7d5e
- SHA512 21142d0235d2ec2c697d7c536635dd6a5fad6677ea4b3a0fff41b2d8e8bf9c52f27ca4c9df26e80afc94b3c263d5e97a4cd3d2a2217e44db383f717feba468e1
- SSDEEP 192:lRaox43v7GpcPRpWzlX9DHsb+WNnRW4e6YUk2IeMK5c5VyIsnAUgraJ:lRaomfiEXg5w4kYd26re
- TLSH T1EE52C82EA910693B5CEBD21AFD667B53D7F6102161901E84FAFC8D2C15EB6CC322741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 152B
- SHA256 f50ce8613a6fac8c93c2df586babae5356aa890983364f992a93ef76bbd5ff0a
- MD5 a138c951c5db8758df5a196e61a35fee
- SHA1 40bce455a7c8e0e0bec5829477d20de944a8db16
- SHA512 c9d7faa52f70058d3a963e924b899b8e525e67ea95db7105a0cc22881c47a5b7fc50139e0daeaf8920a74b22ba35e0d6dd37d7066e248e71e02e8301d60642bf
- TLSH T169C08CE71810C4C6A7B0AFE520387A0CE00B820C8CF0CCE0D448A08210759120482432
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5873a4.TMP
- Size 159B
- SHA256 b334fc84d9713011b3c655e8c58227c9629c8cb2b471e3d8fb6d1b0801393ceb
- MD5 3e96e7796290897eacbb7a5eaa0b302b
- SHA1 fb937e5f00cbefbfb8abb073ff33f2745738148d
- SHA512 2178abacc4b416c622fca50a1fd7526b24dc168096fce42f052168b4540e877eaf169b53c0477962006f63caa4a7c9249fac501ca7c1d8b5913fbbd66e7b63fa
- TLSH T120C08CE7192084C6E7B0AAE260B87A0CE00B8E0C8CF0CCE0D849B08220359134546432
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 55fb1b27715f3471e14d41a95d640b65ab72576b40b1cc6f99f952f982cfd5c2
- MD5 2841d4dafaacb50853e2dd76674e70a3
- SHA1 2f1d1e6fd23f7ffa6a1302ea231f18105476795b
- SHA512 7ea48a905d301e2982a0d92c74c332af4b40c23a113a4f12eb7c57cedf5dccbdc047cbb5a4cce868a45fb28f2497728a98c75fe7f48588860ae29f1537b7316d
- SSDEEP 6144:E7LPobHjxWQ5Em0fXjHLi5yFygm7Rkm1tYpBeh2BAog:E7LPnfm0fX3i5EyT9oBGcAog
- TLSH T1773423226EE4BAB24EBDA359604F1D3B2AF19693D014CF07DCE5570A3762E9C1F06934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 58c0d593cf161094bbcc11b2a1640d9752b48898f8dd8116d0ba15df6b8d10b8
- MD5 f1dc94316f199501d1d825f6a25bdd5a
- SHA1 6d5d71aa6187417e9dfd1959899b036e321b6047
- SHA512 f3ad0b6e883903ba05f9716138562e1cb6b2200e85ba69a7ecdfa45a4269ea7de521a57737957f21fffbb748615df4b76b914e6e56866ff2c7a1d2a6426b47ad
- SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Nm7Rkm1tYpBeh2BAoO
- TLSH T1F9C3123B5D65E9375D79A71EB48E0B1E1EF24DA6C930DE42C8D86A0433FA7CC1A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 c61399a492fbd1e082ad97da927e56b43981754398f1f4b360f9dc4ca5234ec7
- MD5 186c5fbbe891f3ed4e403faa18edc0ae
- SHA1 b39745d609c442250a900931fd130888602ff5ed
- SHA512 943ee65ab2eebca0b038f21518a7080d53a596434ea33c08f396d5d17812d996868aabf8ec7b73d238cd54fb777f97d406fd112794eb1c95ed8522af11819426
- SSDEEP 6144:n7LPobHjxWQ5Em0fXjHLi5yFygm7Rkm1tYpBeh2BAog:n7LPnfm0fX3i5EyT9oBGcAog
- TLSH T14B3423226EE4BAB24EBDA359604F1D3B2AF19693D014CF07DCE5570A3762E9C1F06934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 cbcd94a7db17fdae9728b689e66e7c0c6ddc84686193a79edaac8fadab6bfdfc
- MD5 0dc69f1281997e0e6709ae0a9d5bc5c3
- SHA1 7aece95145d161180d48b3970b50e10c8c473854
- SHA512 b3cda08b537a3e8989cf2bef84e0e1c8ecb989d83d5f2bac6c4f55c0b9af80a621710ff48f4f27b99bb7aa8ac1f2ab0115f0a8d3a0678abc7b7e0291b8f459a7
- SSDEEP 6144:11rLPobHjxWQ5Em0fXjHLi5yFygm7Rkm1tYpBeh2BAog:/rLPnfm0fX3i5EyT9oBGcAog
- TLSH T1E23423722DE4BAB24EBDA31D600E2D3B1EF19797C014CE0BECE567097666E5C0E06974
- MD5 SHA1 SHA512 SSDEEP TLSH