Analysis
- user interaction
yes - max time kernel
138s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 15:57
Behavioral task
behavioral1
Sample
main.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
main.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target main.pyc
- Size 25KB
- Sample260815-tec2hsdp91
- SHA256 a14943668465b0be91d8bd6a2f3f78ebc17374c8c4807056554706b1ee908a7a
- MD5 07285328333eecd954daa3953168932f
- SHA1 83ad40f6c65bfaa0febff6ca8aea8c0a42669fc0
- SHA512 a78875f319b8111593d6730bfbf06f972bb05d2e6f2c8b2792a0c0838819a95473e23fff06044084b5794715aa4a9e935273a835570145d944629278a5f9b8e0
- SSDEEP 768:j6oFkbqcxqhgn+1EbC5YNFCTZTWOGuzK9Tpq2S1pSxwrg:2oF6qWqhgn+1EbC5YDqZT/qpxWpS+g
- TLSH T1A2C2B5906F5AC87BF804F13684262B0FFB6680BD3A569703B5AD542C6F92475C87C2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2852 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 432 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312830910696277" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c00434653461600310000000000ad5c6ba7120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbead5c6ba70f5d417f2e00000063e101000000010000000000000000000000000000009989cb004100700070004400610074006100000042000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 5000310000000000ad5c57b010004c6f63616c003c0009000400efbead5c6ba70f5d417f2e00000076e10100000001000000000000000000000000000000a0f824014c006f00630061006c00000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000000f5d647f100054656d7000003a0009000400efbead5c6ba70f5d647f2e00000077e10100000001000000000000000000000000000000e9591d01540065006d007000000014000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "3" chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ad5ce5b0100041646d696e003c0009000400efbead5c6ba70f5d417f2e00000058e1010000000100000000000000000000000000000060b13a00410064006d0069006e00000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000ad5c6ba712004170704461746100400009000400efbead5c6ba70f5d417f2e00000063e101000000010000000000000000000000000000009989cb004100700070004400610074006100000016000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 4400 chrome.exe 4400 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe Token: SeShutdownPrivilege 1040 chrome.exe Token: SeCreatePagefilePrivilege 1040 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe 1040 chrome.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4556 OpenWith.exe 1140 chrome.exe 1140 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe 3804 chrome.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1040 wrote to memory of 4816 1040 chrome.exe 91 PID 1040 wrote to memory of 3340 1040 chrome.exe 92 PID 1040 wrote to memory of 432 1040 chrome.exe 93 PID 1040 wrote to memory of 3340 1040 chrome.exe 92 PID 1040 wrote to memory of 3860 1040 chrome.exe 94 PID 1040 wrote to memory of 3860 1040 chrome.exe 94 PID 1040 wrote to memory of 1672 1040 chrome.exe 96 PID 1040 wrote to memory of 1688 1040 chrome.exe 97 PID 1040 wrote to memory of 1672 1040 chrome.exe 96 PID 1040 wrote to memory of 1688 1040 chrome.exe 97 PID 1040 wrote to memory of 1952 1040 chrome.exe 98 PID 1040 wrote to memory of 1952 1040 chrome.exe 98 PID 1040 wrote to memory of 2788 1040 chrome.exe 99 PID 1040 wrote to memory of 2788 1040 chrome.exe 99 PID 1040 wrote to memory of 5004 1040 chrome.exe 100 PID 1040 wrote to memory of 5004 1040 chrome.exe 100 PID 1040 wrote to memory of 3628 1040 chrome.exe 101 PID 1040 wrote to memory of 3628 1040 chrome.exe 101 PID 1040 wrote to memory of 3132 1040 chrome.exe 102 PID 1040 wrote to memory of 3132 1040 chrome.exe 102 PID 1040 wrote to memory of 2044 1040 chrome.exe 103 PID 1040 wrote to memory of 764 1040 chrome.exe 104 PID 1040 wrote to memory of 2044 1040 chrome.exe 103 PID 1040 wrote to memory of 1140 1040 chrome.exe 105 PID 1040 wrote to memory of 4288 1040 chrome.exe 106 PID 1040 wrote to memory of 1072 1040 chrome.exe 112 PID 1040 wrote to memory of 4176 1040 chrome.exe 113 PID 1040 wrote to memory of 4072 1040 chrome.exe 114 PID 1040 wrote to memory of 1700 1040 chrome.exe 123 PID 1040 wrote to memory of 1700 1040 chrome.exe 123 PID 1040 wrote to memory of 3804 1040 chrome.exe 124 PID 1040 wrote to memory of 4400 1040 chrome.exe 125
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Executes a command shell one-liner
PID:2852
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4556
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb8ab2c728,0x7ffb8ab2c734,0x7ffb8ab2c7402⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,5753352851365214109,16338033484693742272,262144 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1820 /prefetch:22⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,8070074958104388801,385098197272384569,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:32⤵
- System Time Discovery
PID:432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15479989512061104751,16616389971130851294,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2568 /prefetch:82⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1183488098258966016,11477805035702846895,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,13819184946964264381,18403037787538797239,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,17374326345541783265,17396551783963195757,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:22⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,5452904305413864324,14165927282177574220,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4988,i,17094371449084177707,2750623661267024050,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4788,i,5531387899740300456,7485236292402469364,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3252,i,3847548092821242454,11066575586836801861,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,8672050669237771440,233197879093121679,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,116621061021075791,11986810845881191381,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:82⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,10243725550990189978,18204314059627711984,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,2645202366789505155,2777496336440503991,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:82⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,3227459580082531228,13996948971619887322,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5104 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4440,i,14631624026912540842,3734191706850109354,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,15744517921151061154,7369663549968435429,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4468,i,5854248435516993382,3346987256514675398,2097152 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4520,i,18131976863752129234,11663533297440353755,524288 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4456,i,9426669057164358581,14492494981740522348,262144 --field-trial-handle=1824,i,14001501655362547065,9416280320536064836,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0fe2fc46-4c20-4254-a4f7-0d83de831a45.tmp
- Size 239KB
- SHA256 4711eaafe023ece4a8498b89018588400d99e5b429b8ce64dd3c23e9f1fa61e4
- MD5 c9393050f9481004807b910e3f4c11e9
- SHA1 8e616aad03158c2f5a6d603ccb4ea335f3e1492f
- SHA512 45ba9e2539ba56d1247403a6fd2f1819c5c40c3178cb7aad2528394a8bcf419da4ea35bde878447933477ad2947c9ffa1ccdc3c48ac6563bcb270e8c83ce47f1
- SSDEEP 6144:xAQeTh4tPl/HQFlGMUESPGim7Rkm1tYpBeh2BAo1:x4ytRkl+Y9oBGcAo1
- TLSH T1673422622D92CD3799F9672DB00E5EBF4BF04D62C9498D51C9C5AB0472FA7C9440CE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 a73f1f6a37e9216ea19a6ea3fdf59d702213db4a7ce23cc61a34439acd3c5c48
- MD5 b3a5d5f6660419b0e4d8948abed90c44
- SHA1 aa463c02fdb80a1705152674d3a2a8b84c240abf
- SHA512 09ebe1e32d36093bc4ade1ecf898afbc55fc26a7772b799a8b895f62d133f709b614f8d06c7c7a8b15a81d97ccbac5d4e7b4303b89350e6442815b251122c51f
- TLSH T17AE02BA9C821FD270CFD576D50904B45DB2013571760C85B3F3C81088FB16AB068686C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 2206fd78b77c2d6d7b49b9188ed413de200684a2e2497ae03729138ad3260415
- MD5 816c8366d2f31d18ec3b9212cb2f9782
- SHA1 68b561e8b928e910492d0d6df71379f157dd0247
- SHA512 ca9724273078feb3a50e39e21bd8b3b5e2940d6cd08d8975642d833626f921d3bcb73c0d8f885f3bd55f0971eb595d9b32b7d4ee9a1708fbee75f133b12371c4
- TLSH T12CD0122C16D6A109EBA7B2B121F26B403031062E1E0B5B1303E01CAAE92B3DE5582356
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 884a6e2181021121b71c7340725926c3dfafc8e26b99a6be8ab905877b7b575d
- MD5 bd363f7d2bb7d55024d2506d3f990744
- SHA1 12d8fe4e1be12b0f0cb7d4334601164174c4ff70
- SHA512 9cf295085e0f8cdf58e6913a6835bbd638e6d1f0931660514315bc17df29a84ceb477d746d3ee1388c08fe75b0fe63fe4b2ae655238d59dad2f8e1062a0c01d6
- TLSH T1E4E02B1D41CEE100CB8332F054B18E652121019E1E06332202905C5CE8136EF5942719
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 fcd2d5109afd0cc183f39822ca1e5c3292dfe7fdec59fc047e015e81ae0d75c5
- MD5 c6f939ad1377bb9c8b824383912102f2
- SHA1 ff291ac8c37e9299495161aac56f31a37feb7daf
- SHA512 200a4af2f5dfc1833653e86ca8707571ca43bc980480766d5b8b79fd84cb494e0fc8ad90e54469e236a391f0324cfdab05116e6b7dfd91a217530e74c00a83c6
- SSDEEP 192:Dq/JKef72aIwVSo7Akpj57tzryaFtKkxNjhjRS:Dq/JKef72aIwVSo7Akpj57tzryaFtKku
- TLSH T1B7D19DF3C7E89A7E8D2151F5BA246E1BCD2D0D14432C3D66C9DAAE4BA3E2831D24154F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 0aefe49f8313109bd09874fbb4bae9284507232d5b0e1807c3b73c4cfb2e08fe
- MD5 7021d522c2fe50eb72020eacc459d1ee
- SHA1 d3b78c11fe69c79a23748384e0baadbc1d6ab810
- SHA512 62742bf4cfabb11624b6b49d474152ded1e2a9ff7481b5083923aa288e1d42e3f2833fca05237bbdf16b53adadd0da11463395247089c76155359276d6132a1b
- SSDEEP 192:Dq/JKef72aIwVSo7Ak7snzrNF58ziiFIqS:Dq/JKef72aIwVSo7Ak7snzrNF58ziiFg
- TLSH T1F1D18DF3C7E89A3E8D2151F57A246E2BCD2D0D14432C3D66C9DAAE5BA3E2831D24154F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 38ff10075d96caeb32922baa745af8b0fb5b5a8e7b67579a74dbec06e2bf7676
- MD5 95b2dccf09e46dd4302b042720e5c834
- SHA1 6e182dc9b16cf868e6e5a3c6e0981958ebbdf36b
- SHA512 4ddd55166b850a012b4ff685fd251eabee6daa0e91cc578ce7c8867bcc811e8cd5e85bf4cc9113eff2182fec5c87fd3064a2da05f4ecdf585f1ba864c1460f29
- SSDEEP 192:wRNkj78ghbv7KpAPRp2YlK9qHsb+WNnRP4JPeT2T7kwiaiuIbVyIsnAUgraJ:wRNk7jeUXmkwlqeoCaCe
- TLSH T1B252B62EEE107A7B9CDAD219FA65BB53D7F5103521942E84EAFCCA2C14E75CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7214c55a1a78e5f7fb7cfc4fb97c1d3e218a184490dd7fafe7a8c819e3eb8335
- MD5 69df2af0c7fca555679e3759ef9af331
- SHA1 7654c0ae3eb360047632a0ad0b28c6b210207a8a
- SHA512 8354dfb75930500a15bfcedb87100ce6b10b523c617bd125db22dc3eb632d64a44573495adb232abab3129e441d6996911984caf0710fea5b2f98ca27ed8e3cb
- SSDEEP 192:wRNkj78ghvv7KpAPRp2YlK9qHsb+WNnRP4Q+2U2T7kwiaiuI2VyIsnAUgtaJ:wRNk7neUXmkwlG2hCaH8
- TLSH T19942B62EEE107A7B9CDAD219FA65B763D7F5103521942E84EAFCCA2C14D75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 d5d4c0a6146cd1d9258884db9ff8885aa2353aceab29ab3fefdfce3f631332df
- MD5 c697e6821fdc016adb5606ff05227373
- SHA1 ca1cf714f107f08e342ddb2d78a824507fdf55dd
- SHA512 e6195d5f7135ba87af4d778b6e7aa2510bc86fce9d61cb511c22acb4c9478564cf8f6cf9e60e6f72d112516399dbfac08731f991b4a5797731f4ccbcf2c63445
- SSDEEP 192:wRNkM78ghzv7KpNPRpFYlK9qHsb+WNnRP4lyE02T7kwiaiuIJVyIsnAUgraJ:wRNkELebX5kwl/EBCa+e
- TLSH T17352C72EEE107A7B9CCAD219F966BB63D7F5103521942E84EAFCCA2C14E75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 d1d255ecdb72e8bcb57445c557bcff5d99bc7b57a21c1ca9efceb439956e9180
- MD5 73431941691e076c22143de5cbb999d6
- SHA1 8c806960d77307115fe0bc0eed8a46911aa3b625
- SHA512 eb4be32fdd4fc308aacc258e6801ee3a7cffca76530334d92d39f66fc62e5bf575fe26e4a567204dabc6ac796dc0925404ecf424bc8101b4ef85f9a59883b584
- SSDEEP 192:wRNkj78ghav7KpNPRpFYlK9qHsb+WNnRP4lyE02T7kwiaiuIJVyIsnAUgraJ:wRNk72ebX5kwl/EBCa+e
- TLSH T11D52C72EEE107A7B9CCAD219F965BB63D7F5103521942E84EAFCCA2C14E75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 129bf9f28ecf6ebc9ce0a85e4b7c42a232d370339cd7ed0f7d2533f494ae90e3
- MD5 ea2ea3763dad07d75f68f1a9956bd87c
- SHA1 a40b29163c78741eb65463c3c780ad19ce02058c
- SHA512 ce944e627e31664c66a99b0f94070819c09ee7f4374f4a94736364c936329c83f5d460dad9f5c7927bace5c1c8d37844e638b2dc3ebd418be2aa7e9f47fc2665
- SSDEEP 192:wRNkj78ghJv7KpAPRp2YlK9qHsb+WNnRP4Q+2U2T7kwiaiuI2VyIsnAUgtaJ:wRNk7JeUXmkwlG2hCah8
- TLSH T16D52B62EEE107A7B9CDAD219FA65B727D7F5103521942E84EAFCCA2C14D75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 ddcd4e1b730495ee156b6aff52ae62998b98ac86cef1fe3db4c6596cfcfb5b3b
- MD5 fb56b3520e71e9d78de8e9c64e5324c1
- SHA1 9b05d20ce353962b5ab60ecd871fad3a70a26ad8
- SHA512 91ef0f57ca7656e92b1db148569243480ab957c2f08184115efdf1f47eba6c5ece1488b2dc97652a4837387f6d79bf4d66c2a61e541c088b9d1e7165a2f4aebe
- SSDEEP 192:wRNkj78gh1v7KpNPRpFYlK9qHsb+WNnRP4lyE02T7kwiaiuIJVyIsnAUgraJ:wRNk7FebX5kwl/EBCa+e
- TLSH T1FE52C72EEE107A7B9CDAD219F966BB63D7F5103521942E84EAFCCA2C14E75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 0dabcf93e5dd96714b62c4b03ae7ec90ba0e111390163d91f6e872a5bd7c8849
- MD5 a6a33607f5dbc5797e813424f97c5bdd
- SHA1 50e236441b2ef082820d8da242a010939299b2eb
- SHA512 7c325f050cb28742d94601fe362cc12b90ebea03aebb6717a12b25a77454821b81b235bf9f1a5e69b1e9ee697cef550509e284ddf73c59d3b1e59115dca1ff9c
- TLSH T11CB01201C0025511C0C207F0114218DC7124DF10960B270153E07922C8251A18424191
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588335.TMP
- Size 96B
- SHA256 84c295570ec422f160d703409c504f30bd116e28ae6691b3c547e33ffa816f3f
- MD5 57b8e519f1c7379aa9d9a14bd2b4233d
- SHA1 05f8ba5a38e472f59376af61a9aba3a57b9b7f4b
- SHA512 f2ddcfa6c1a2c5a307e922b667703452e315c7ba4bee84d089bb8b7d027fb5abac7669ec574ddde09c8a2c727ea230ecd99f26260513463a4902c480f6772cc0
- TLSH T104B02208C00A2223C20203B0308080C83020CF20CA03230282E00A22CC322308038230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\1e87f72f-552e-44ed-a1a5-b35b80668031\index-dir\the-real-index
- Size 72B
- SHA256 26c77cc33d659b537c0b8cdc817c699ec7b96fa1d74900c4da79596690c2dea5
- MD5 a975f1d8d02ce05f98a8dbec83400b26
- SHA1 ccf88321ebfc22b4695445460fc797729b8b9329
- SHA512 293c3f883711f319ee6d20d65b90d3c9c9cc8c49a43ae01ea39475c47ab4ff473cd476702174cddc7b0f584ca70a3ac1bcdc5c167c03b60f0b5d2a4b244a951d
- TLSH T149A0022C15509200C90451F06557426232358D20E8494A17C1D525E4D8E59A9415753C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\1e87f72f-552e-44ed-a1a5-b35b80668031\index-dir\the-real-index
- Size 48B
- SHA256 da0f8d351b80dce37f7a9b653f6396449d951a59ab51fdc2b361390c09d3d798
- MD5 b874746aa1c0cbc1035dc4f6bebce6fe
- SHA1 01b15c195cfbc23b5a7ba7ed773ebe419d0b8164
- SHA512 af576670308478582fb7d5719220c74ca974bda311f343d3a613868220692057a5e26b4a6282ee89fc9e62fff1087936ec8a7d0714a923b5e152b7c681b458b7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 153B
- SHA256 f7684c03dbde8f6ba72fadf6777aa8565c9cd8c20f27d091831e4dfc878271e3
- MD5 f525771dc6ca56ff877278d1b7a26466
- SHA1 ac329daa1fc7cb78f62e9e74d72e494ba1131d2d
- SHA512 71695ec92939d79cac960fa842a9b04cabf511b078fcda1d5c44e892ebb7642d13262ce50ce092268a2439d2da4feb0fdd4bd2dff8f7347a8c1513c1aaef647f
- TLSH T1A6C08CD72724498B8B30E7F41038732CD607864D8CE6CCE8E10860821074412C802A64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 78B
- SHA256 d82dac03c5b49330ad09c959b42cb5123a3e521ddde5befc624efd966d760037
- MD5 fcb72bb63dc7fd744036aef301a3a465
- SHA1 5f18eb2cb4c968f9433b0dd9ef57bdc41f1b5f9d
- SHA512 dd1a9af69f3b5ed9aa3720dfa58b527b1f486bd2a3c67d7070567e6b4ee2abe86d1df63c6d877f5e6b7834a45412611bb725ae9d3cf8831cd6c835ca8236114f
- TLSH T14DA002FB1808848A1F70BAF82479B71DE00B828D8CE5DEF0C408B0E22179A3200039A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 159B
- SHA256 c7f52957522918b9c8fac0e987eaf2f19128909b82e131263efc3f16887a45a2
- MD5 03ad844668d2302ecb2ebb85c8e16ae6
- SHA1 27d54074428721f5fb8ed3823734f7953f4a125c
- SHA512 e600f835afeea0c5f53c8d85743c179dbc7929f0bb62018d4ce925ebc31dc65c2cda2e0db0a381803205ffc86d4718f1228538363f15073209f0b4a988c2a6a9
- TLSH T10CC08CD723354E8B8730A7E05034732CD5078D4E8CD6CCE8E10A70822034423C502A64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58433e.TMP
- Size 162B
- SHA256 2ce285b48872150282a4914d767946d537e5693aea525770fdf1656955068a75
- MD5 c19ceef636910c39f6ae6b8c011210e1
- SHA1 7741e84e92eb48fc94a494f58de9526ec0476e45
- SHA512 dce907006498eb125e5402ba8fe578a5c58a2eda051cd096cb708a9800b5aa005c6d970bbbc1cfc5c386857957b3a2ac8be195bc7d04237d9313222505de349d
- TLSH T13CC08CEB553159A6BB20B9E41438360CC0279D0D6CD2DEA8D400B0D220B8252C2026B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 567debddd8732d8d7c6d51b926cb53f2bba008dae1dc6e61ebbe08a9ef725785
- MD5 4ccf3dd391b34e7ff421e1a082164eb6
- SHA1 8d2aceb9aac6c2ff4d709a64da7e7bc747717f47
- SHA512 fe07a5b47a12f0aa78b5d1b96a91864434759318a7660cc3fa984267be08c194969e810c19e580b09d31cd0e156c0d6fe1b16865892842a995798fa65abf5f1c
- SSDEEP 3072:AUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:km7Rkm1tYpBeh2BAog
- TLSH T192C3023B5E75EC3B5CB5A74EB48E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 c3f0908eb4e66a85907ce5de436068d45c707fd0a296b13576bd264b5ef58dfd
- MD5 e8b1b847177a5e7050c876053111e2ab
- SHA1 f94da07e27f200ff18e1d208a8e433f1f85a6036
- SHA512 c56a2485c2aad28b37d5bf91f90e8693013e232fb62cd75c30c17b37acdda4a61970bc59dd6e569e052ea7252c1db16634cc23ce80d943bbe7f116351fbeea6b
- SSDEEP 6144:UHAQeTh4tPl/HQFlGMUESPGim7Rkm1tYpBeh2BAo1:y4ytRkl+Y9oBGcAo1
- TLSH T1FB3412762D92DD3799F96B2DB0092E7E4FF04E62CA45CD45C9C96B0472EE6D8880CE34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 df76f50ecb58582aa2147294ad0601b7e0d57f0c7ac43b3fb9a6994fcce8c9ac
- MD5 7b6bdbb0eb9682be922061dfa2c9aea4
- SHA1 9afa53ed293ce2fd3992dcce0ee5709a113cfaca
- SHA512 d16f7298f1a6109b8fdfe59c0cb28e1251a6aed30db5e8399d83a18ba0695db98bbebddbb3e2fe214ec11dfb20b8e4c7c249f754ac72f184bf4525db3554c6fc
- SSDEEP 6144:0AQeTh4tPl/HQFlGMUESPGim7Rkm1tYpBeh2BAo1:04ytRkl+Y9oBGcAo1
- TLSH T1B53422622D92CD3799F9672DB00E5EBF4BF04D62CA458D51C9C5AB0472FA7C9440CE39
- MD5 SHA1 SHA512 SSDEEP TLSH