Analysis
- user interaction
yes - max time kernel
64s - max time network
66s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 13:38
Behavioral task
behavioral1
Sample
main.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
main.ps1
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target main.ps1
- Size 137KB
- Sample260814-qxtkfavyev
- SHA256 658a2714bbb0d21b8c5e9142c0a4cc2a49ba0eb6ba765782eed3fd3b9b5fe609
- MD5 952ced2a3e9a2bc5449f150c254c2fae
- SHA1 1182966b046875de25fbd73711eef2549173108c
- SHA512 037b7fb106b7f961b650e33d36df19bc4bcb13ce124f7fc919cdecc13277fe42051eac56716371910f674b98cec1ebf81a5ff604cc335d88e8c7a03ab4e8d3aa
- SSDEEP 1536:5AmSXahzrpTVbzrskTtmO+rdNTrwd3gDVv50anCuwhlzsUl3uAQooF5vNVB7/:5A2h3nm9ZFrwxOVv5xtw0R1fFpNVB7/
- TLSH T152D3C6D2A474895EEF10B17484E94494E76D7AC3B210CB23250F42767EDBAAACEDD34C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 4340 powershell.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2552 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311883860591187" chrome.exe - Modifies registry class 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{83BCABE4-69B2-428E-9AD1-6FA2A8E2C46D} chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000344a71fb19e3dc01ca1da2ce26e3dc01798a9a5ef22bdd0114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4340 powershell.exe 4340 powershell.exe 1456 chrome.exe 1456 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4340 powershell.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe Token: SeCreatePagefilePrivilege 1456 chrome.exe Token: SeShutdownPrivilege 1456 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe 1456 chrome.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe 2472 chrome.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1456 wrote to memory of 3080 1456 chrome.exe 98 PID 1456 wrote to memory of 2552 1456 chrome.exe 99 PID 1456 wrote to memory of 3776 1456 chrome.exe 101 PID 1456 wrote to memory of 3776 1456 chrome.exe 101 PID 1456 wrote to memory of 4836 1456 chrome.exe 100 PID 1456 wrote to memory of 4836 1456 chrome.exe 100 PID 1456 wrote to memory of 1780 1456 chrome.exe 102 PID 1456 wrote to memory of 860 1456 chrome.exe 103 PID 1456 wrote to memory of 1780 1456 chrome.exe 102 PID 1456 wrote to memory of 860 1456 chrome.exe 103 PID 1456 wrote to memory of 744 1456 chrome.exe 105 PID 1456 wrote to memory of 744 1456 chrome.exe 105 PID 1456 wrote to memory of 3724 1456 chrome.exe 106 PID 1456 wrote to memory of 3724 1456 chrome.exe 106 PID 1456 wrote to memory of 3468 1456 chrome.exe 107 PID 1456 wrote to memory of 3468 1456 chrome.exe 107 PID 1456 wrote to memory of 1068 1456 chrome.exe 108 PID 1456 wrote to memory of 1068 1456 chrome.exe 108 PID 1456 wrote to memory of 1800 1456 chrome.exe 111 PID 1456 wrote to memory of 988 1456 chrome.exe 112 PID 1456 wrote to memory of 988 1456 chrome.exe 112 PID 1456 wrote to memory of 3816 1456 chrome.exe 113 PID 1456 wrote to memory of 2472 1456 chrome.exe 115 PID 1456 wrote to memory of 816 1456 chrome.exe 118 PID 1456 wrote to memory of 3404 1456 chrome.exe 119 PID 1456 wrote to memory of 640 1456 chrome.exe 120
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\main.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb810fc728,0x7ffb810fc734,0x7ffb810fc7402⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,14313672942714782976,9953757840309058717,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:32⤵
- System Time Discovery
PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8675288369075845444,683212511575483934,262144 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1820 /prefetch:22⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,4083590288473481353,310634858011426896,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:82⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,3113246071755608579,8487576985162815053,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,14467886512413058774,14178845992179758197,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4576,i,11192041827431655130,1843931632417908880,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:12⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,11845160480954826647,10836771148510653201,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4592,i,14191670907887042966,13503767885410023633,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3428,i,17939513320058836312,14723308285171414411,2097152 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,5148958078897305634,1944029940332614440,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:82⤵
- Modifies registry class
PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3100,i,14406849139429274416,10544966262272965060,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:82⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,17667509494270986511,15123099983031543820,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:82⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,578985694848578313,2746781579899002433,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,3216570355653540099,285853885779138553,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:82⤵PID:816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,6986772225288466522,663907064329224590,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:82⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,13218497902649647322,14379568344876572376,524288 --field-trial-handle=2136,i,2292481345183390881,9591364638707221742,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 68f257c95fc5d851279beaf050aa47c97343a9190492d39c8600411cbbdb06ce
- MD5 1be17dc86f2202415bc839275c32a3e6
- SHA1 541a63afc2d3a662cd6714510f37306c0e12b7b2
- SHA512 820c17b8d6509f2f3055a89ea224491068197f1146aaa4f1a541aa0d140fde43841d86a789b7b50a03d2c890546043f7f6d6d4d1f78d6da72ed5a62f4b27f0df
- TLSH T145E02BAADA35EC279CF9172C90401B46D75013973B40C94F3E3C8009CFB5A7A05C981C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 bd565c96377abe8e1ec9215d8fafc172d0dd0bc6e071dcf2496cb3f42f30fd67
- MD5 e1d406190cfca322562eeb59cf3d9e17
- SHA1 49670f4b0fdb2d0f9cb22e97f20988c2bbfa5fe3
- SHA512 84cf3679df06d57940e721d8b7e1d925bb5904a4655440ed554cff896d473dc3eb2a2c4a0065a3b5544376360fdd1a75774a113d2efaec225442268cf29cf6a0
- TLSH T199D0126425C45549EF1466B134E81C1EF1591519092B1B0383FD2CAE9C1F7EE3143052
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fae7361925d2e8f6c8b07efcf046d65f24b45f2221c3decbb78e3e24016bb1ec
- MD5 2f1ef28e24aaf56f00737e064d3f5b79
- SHA1 b908a5638f5742bfdab42836e16230e54b0b00cd
- SHA512 7903c6cf7ff31a769513a19ae4ed509b1fced1547976ebae7701c8630451272fc30a994f786fbc638538a193dea3ee43516214d692f3f6579bfe59d9a91379b5
- SSDEEP 192:oRT4x/5vOv7apAPRp2zlA9DHsb+WNncD4l6eh8fMBacVyIsnAUgraJ:oRT4d0OUX75wA/eefSe
- TLSH T1C742E92DB950697B6CDBE215FD617B57D3F2106261E02E90EAFC892C24E79CC312700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 71589884c318cfce1a20afae588b27fd3bb4c2eb55631090e01316b2ed6277da
- MD5 93ab1921eb342b5a81a538ba2e311633
- SHA1 864e2aacc5270586bca44dafb17eaec529aeaefe
- SHA512 5cafa4fa11d6d06c93f3ce88cc80823edaca8c36e307e28a3667bd1c20be295d161dc3d81de759eb59b102e27e21342015ec14d765c55b832b1567a1255d59c8
- SSDEEP 192:oRT4x/5UzOv7apAPRp2zlA9DHsb+WNncD4+N2q8fMBahVyIsnAUgtaJ:oRT4dPOUX75wAP2ffJ8
- TLSH T12B42E82EB950693B6CDBE215FD617B57D7F2106261E02E94EAFC892C24DB9CC312700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 152B
- SHA256 b5d452cc983f2b0071c4b294a5df6a8f52daa4811a688fe65916f12564416ba2
- MD5 46c9ea3e686dc48b3075e35a77687241
- SHA1 13c349fcf7a5cb9d2ea29d56ef9a6254e275f0e2
- SHA512 ac5a8714ff95b62d44b213c2d89651782a32692002babb8829701d8f9d821ef9dbbd8b15bce18ba42e15d1a1d8abd9a46415348f97b1b61b5d1c826317049a8a
- TLSH T176C04CEB68208A9F0774EAE91875765ED207C54C4CD9CCB4E604805525B9D625412969
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe590ac4.TMP
- Size 159B
- SHA256 1493a665b7ddbd750694ef7b8595170dbd10263737899575e47137d25bfacb88
- MD5 db72a51b9b25d992141c15747003f9d8
- SHA1 7eccdeb62b8e45c6bbc5930871ccecacaedfc274
- SHA512 0ac2d32b5ef222ed80f10955138ed7db953e33917d0b04430ed26d3858b8a98828aea77a9490c960534cd764f9626cc41450b04e99b4a67d38bf273f7e220dec
- TLSH T1BBC08CA76830498B0730AAE61834720EC207CC0E4CC8CCB4E204B04120B8C239401824
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 559da4f56b03bca8887c4bc523512b1ecbb1deda290da12d67174c237d2aebd3
- MD5 e8044885f46901271f7eff1cae06fa0e
- SHA1 f43d998de0e2fd3f89cf701f5e26a69d2ed00a01
- SHA512 a4aa783bd2e1047e0477bd0a017663ccb39ef0018a28ccd5ec68de45c1ec6ba6bada96a15ba5d7174531455e1cb2bd93a6394b107629cf9a7fe9444111eb9ea0
- SSDEEP 3072:GGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:xm7Rkm1tYpBeh2BAoO
- TLSH T15FC3123B5D75E9375D78B70EB48E0B1E1EF249A6C920DE42C8D86A0433FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 c1af8e0de9253c250fb098026738b73529d26a9d7802db26cc5a1b475536a9f4
- MD5 1a95122f2fd92a0e29a050b2536d45d7
- SHA1 2a135aac1f9045d30a3f16b328a264ce84558904
- SHA512 dc78c1d57fa09fb230fbfc627adc5bf92cad242839267fd09a2efb6ee534fef64fe5016159cf27f9ce65d59330a8a7f7c0d92fe3f2cf6e54205bb02313ff64e3
- SSDEEP 6144:yBgRG3Cve81mEU6ulN0yzeMGLm7Rkm1tYpBeh2BAo+:yaIUmBLl99oBGcAo+
- TLSH T1D534232B6D78A97AA8BD673AE04E1B0F0EB35DE1C824A75589D18E045FFB3CC4546630
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 c18870086d7d63dbabb29d4716b4cc32dd18b7de0835f809c5f6cdba99e540d1
- MD5 851dce4fae8f4a778ae8c51b986a987c
- SHA1 8a149ab7d033e09134ec945864e5a72d4a1ee87e
- SHA512 07b115f56836f857555de05ade830b47a3eaa79f73f7bf7be6390332b30bd2cef2127d782812a784e20381ff344fdfb657f38000f5734694df3a73d78aaee60a
- SSDEEP 6144:rBgRG3Cve81mEU6ulN0yzeMGLm7Rkm1tYpBeh2BAo+:raIUmBLl99oBGcAo+
- TLSH T15834232B6D78A97AA8BD673AE04E1B0F0EB35DE1C824A75589D18E045FFB3CC4546630
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 bdb5ca99dd0e2090e839c122929c2b40c418d619d269604cb27000f4a1909d5f
- MD5 d4c09391a9b615f78cb0f521fcfb1eb6
- SHA1 b8568efda17fe90940fcd7ad279c7af5b699325f
- SHA512 f621d732f3114bc9be6c530f2e022dbb051fbe1ea2ae33a6978e993c12dc7575e93b2e9564244c28ce8df7ab75aadc694f75a0129ad416c911cbd25f3853c1dc
- SSDEEP 96:Vu3sqp+UwounRc/sjghkYAOQD9bVT4Gc8Z8nr+:nRouRc/MNz9l4Gc8Wny
- TLSH T128D2C5627D70D650C449653C9C6BDFEE2E29FECADE2950237AF2F76F19B48078108218
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_locgo10m.uzv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH