Resubmissions
17/08/2026, 15:34
260817-szvlmatdmd1017/08/2026, 15:32
260817-syqw2styfx1017/08/2026, 15:27
260817-svt5astycz1017/08/2026, 13:02
260817-p91zls1brc10Analysis
- user interaction
yes - max time kernel
510s - max time network
510s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/08/2026, 15:32
Behavioral task
behavioral1
Sample
2026-08-17_80df1baf1f36a630443ae97b07a1fcbd_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target obfuscated_compressed_InviteGraber.pyc
- Size 180KB
- Sample260817-syqw2styfx
- SHA256 44a64ca315e913305ccb9ed341272e2dd17a29105a9ffb67151564bb6e81763a
- MD5 10d33cd7d76dacb6d72d36bc27a98dcc
- SHA1 05a6c9dcf3c9832e65a35965f5366e43fe6ad27d
- SHA512 02511e6a57612ff5844b72412d0bdcca1369a804574c6a0a5b3b6c9d17877db1d53089232f6e075de5467b4f1e5065b9b885ecd684369090f3b06229eae2d496
- SSDEEP 3072:9o49kLOf3z8iDe5Yh5bswrJJFlo0VRGGPRMLqEZHqEHVQnzpMOBedsn6KvQGzEaC:3ZzW5YZDTcuRGXZKEHOpMOB76wNzEadw
- TLSH T10804A2E48A40D4C255DE6EA67F5328CFA070D3E74B8952CB4E88B64D56FC842E1DAFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3924 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2520 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314543593970757" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ad5c84bd1100557365727300640009000400efbec5522d60115d0f7c2e0000006c0500000000010000000000000000003a0000000000a220020155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000ad5c84bd12004170704461746100400009000400efbead5c84bd115d0f7c2e0000003257020000000100000000000000000000000000000053d2f3004100700070004400610074006100000016000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 chrome.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{9189D484-81D0-455F-B562-EDEB17D8F73E} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000ae5c4a0010004c6f63616c003c0009000400efbead5c84bd115d0f7c2e000000465702000000010000000000000000000000000000001c9f1e014c006f00630061006c00000014000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings cmd.exe Key created \Registry\User\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\NotificationData chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000005ef3ff6232e3dc017740499d3ce3dc01608a16b15d2edd0114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ae5c2a07100041646d696e003c0009000400efbead5c84bd115d0f7c2e0000002757020000000100000000000000000000000000000089d78e00410064006d0069006e00000014000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1724 chrome.exe 1724 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe Token: SeShutdownPrivilege 1656 chrome.exe Token: SeCreatePagefilePrivilege 1656 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe 1656 chrome.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4872 OpenWith.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1440 1656 chrome.exe 84 PID 1656 wrote to memory of 596 1656 chrome.exe 85 PID 1656 wrote to memory of 596 1656 chrome.exe 85 PID 1656 wrote to memory of 2520 1656 chrome.exe 86 PID 1656 wrote to memory of 1200 1656 chrome.exe 87 PID 1656 wrote to memory of 1200 1656 chrome.exe 87 PID 1656 wrote to memory of 1936 1656 chrome.exe 89 PID 1656 wrote to memory of 1936 1656 chrome.exe 89 PID 1656 wrote to memory of 4064 1656 chrome.exe 90 PID 1656 wrote to memory of 4064 1656 chrome.exe 90 PID 1656 wrote to memory of 1080 1656 chrome.exe 91 PID 1656 wrote to memory of 1080 1656 chrome.exe 91 PID 1656 wrote to memory of 3352 1656 chrome.exe 93 PID 1656 wrote to memory of 3352 1656 chrome.exe 93 PID 1656 wrote to memory of 3328 1656 chrome.exe 94 PID 1656 wrote to memory of 3328 1656 chrome.exe 94 PID 1656 wrote to memory of 2612 1656 chrome.exe 95 PID 1656 wrote to memory of 1432 1656 chrome.exe 97 PID 1656 wrote to memory of 1432 1656 chrome.exe 97 PID 1656 wrote to memory of 4984 1656 chrome.exe 98 PID 1656 wrote to memory of 4984 1656 chrome.exe 98 PID 1656 wrote to memory of 2180 1656 chrome.exe 99 PID 1656 wrote to memory of 3184 1656 chrome.exe 100 PID 1656 wrote to memory of 1728 1656 chrome.exe 101 PID 1656 wrote to memory of 3712 1656 chrome.exe 102 PID 1656 wrote to memory of 3712 1656 chrome.exe 102 PID 1656 wrote to memory of 4508 1656 chrome.exe 104 PID 1656 wrote to memory of 4188 1656 chrome.exe 103 PID 1656 wrote to memory of 4508 1656 chrome.exe 104 PID 1656 wrote to memory of 3332 1656 chrome.exe 105 PID 1656 wrote to memory of 1724 1656 chrome.exe 107 PID 1656 wrote to memory of 4456 1656 chrome.exe 108 PID 1656 wrote to memory of 4456 1656 chrome.exe 108
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\obfuscated_compressed_InviteGraber.pyc1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3924
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4872
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7fface1cc728,0x7fface1cc734,0x7fface1cc7402⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,6823583536237311954,13817881175829272883,262144 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,3168751640181416749,1752688423325091838,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1824 /prefetch:112⤵
- System Time Discovery
PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,7213552221030176253,10979267897719128845,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:132⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,7463848126384145300,3347813851508303557,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,9606294619481015150,2606668734653455784,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,8622909932273506511,17203544805436266458,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:92⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,7864330595682972328,17864763956911289811,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4916,i,15281654762883186231,7160882586124010231,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,234657245691924364,1711815088774124002,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:142⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4784,i,6814259436984477459,17736472683914697933,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5088,i,17024596817679956708,9179073153492928894,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,15355104568767506578,2583237440709606057,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:142⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,10598904899394533766,8794724950535451481,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:142⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4268,i,16452199901658342808,15440686246011669765,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:142⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3924,i,5814949013416643807,13038542263424247631,2097152 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4400,i,13208692223289407396,17505212573296169893,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5024 /prefetch:142⤵
- Modifies registry class
PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,3468756988006600708,15901123588700479802,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5012 /prefetch:122⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4348,i,11839595961270858045,1177955091332965376,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,5570676157173215266,11132515804008089217,262144 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4000 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,33163418972515721,7472503083138254618,524288 --field-trial-handle=1928,i,1604405578076750576,4298379158187138203,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4836 /prefetch:142⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 005de2506f18dd4327560eac95511cab97ac7b4f316e5ca8657c10c3d0a6701e
- MD5 e9507ce136a56cee228748e29906c2e9
- SHA1 6c6ada7f00933219d1c50b7091dcbef1c9c744e1
- SHA512 8bfc69a05e1d2546b6f9fd1d4f280d12dfbf65e0f6149604be9d8254a5b582e8f83edec7d7de781bc9cc016c06f13c7176481d60de1d31178170c73ad996e0dc
- TLSH T1C4E022BACA61AC2B1CFC0718A4484A87EB4013762A50A94F3E3D91298FB223A4585C9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 ad67a11aa1af92913666ad3f3f4ab12f50acff47854e59f6f30e46c5001061bf
- MD5 4258ee9ca27516133a1c3a5be9ca83f3
- SHA1 3965c74bde912f32c8ae0169be9bd848467311e2
- SHA512 41c63a6480743546c3a63b7feaf63d67dba4431397f9cd1a4f9fc733f89ff6d2178e0f40991e80083ae8161ded479da49b1b286b9c0a96b4ff140e874261be46
- TLSH T1B2E05E509BC5A925DF58527610EA4CD9B031A2790E175B162382ACFA7923BDE9003818
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 56238cd3216b418f123b3d0ef284c81b7138165e83e3317053d7b9ef2331b740
- MD5 685d6310dd78cef2c8d7567a02a45e5b
- SHA1 2c9cfbced5b233f62c72a056db4420fa0616d0ea
- SHA512 8f7f16562114c04f66d3a99230017cc61bc8f8bfb4bd7f5ffaa532da5cec8c6f2e73664621f877b5aa5b8e47ab7df80e0d222b1f8fa0c4e7124e8a2f56d1ee81
- TLSH T131D0129473C4A525C75C41B610B61CD13021E63D0F07571263D1BCF77A23BCE9143148
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 3c315f70fe2c5e73286874425f107a38c9d2ff3022f496594ce7525abbae75b7
- MD5 8801740f0aec6323244d8466caf53843
- SHA1 fde7aa8a167e84460fb610207d785acd383a3827
- SHA512 432ebbdac9e95d11b8fde45b435b255c54e23f999fecac63c58e5fb5396e4cc16d4211c987cb0835a8265cf0a3c8c1bc7ffa1bd6a5cbafb8e1e8144529eb21fa
- SSDEEP 192:DW5oyOdeOIbDYaII0n9d7AVV2Fzr8Fy3N+5tedg9KK:DW5oyOdeOIbDYaII0n9d7AVV2Fzr8FyG
- TLSH T1B9E1ADF7D3E49A2E882152F47A246E1BCE290D14432C3D66C9D6EF9BB3E2471D24154F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 bbf3a3e4384defec3278fe14a86d18c8fdea2813e4cfe35a75cbcca458ccbd87
- MD5 0e135479ccc8bbd2c9bde8df4577cf13
- SHA1 aa946e6d950c8a1e83fe98091bdaf1c62524298c
- SHA512 da0aedee575c12107d6508a761550fe970ea122107e3096f8eaa8d157b4af443f709f9e880164a8d258f51b57941df965342931dc9d1d124cb149027134dd9a5
- SSDEEP 192:D0ukmNLewhbqHxaII0ENd7AIV2FzrRFy3Sk6edgIInGAe/:D0ukmNLewhbqHxaII0ENd7AIV2FzrRFw
- TLSH T1EEE1BEF793F49A6E8C2151F4BA246E1BCE280914432C3D76C9D6AE5BB3E3471E24164F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 b6763a0a78f65314b5c71ea637ebbe81582088ca8d0cde870743113481186bfe
- MD5 2b75b2450b43533ba4a59020a4127f53
- SHA1 49bf50da698f48ada0c6aa55ae1bebe952f0d38f
- SHA512 f24830d1aca2a6fb689de89872e9e7abcb01038f756b5f7df8d6acfebcb5c9d4af71eacb73231e3358822c1254ba0c88901fea270c3ea48ee5f9e03f6ca2c92e
- SSDEEP 192:DW5oyOdeOI/aII0n9d7AVV2Fzr8Fy3uU+5TS:DW5oyOdeOI/aII0n9d7AVV2Fzr8Fy3uK
- TLSH T112D1CEF7D3E49A2E882152F4BA246E1BCE290D18432C3D66C9D6AF5BA3F2471D24154F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 ed5fc1d39527a012eb3bfbafde6149880cf4acb96540e887c6e2af3692f90de4
- MD5 cea616dcd2b8985f042654fca99da58d
- SHA1 48222ed2827907195b9c55a5bb9d5134588faf70
- SHA512 45054b1d2d84a428175afca6cc24c7c19d5b5e7dc317f44409f43625577ba885997c1f46ff5cfde055604b0e1c11681c5734d928e48641d220c5c58b2ad84761
- SSDEEP 192:D0ukmNLewhbqHpFaII0ENd7AIV2FzrRFy3Sk6edgIInGAeAjhq:D0ukmNLewhbqHpFaII0ENd7AIV2FzrRk
- TLSH T1DFF1CEF793F49A6E8C2151F4BA246E1BCE280914432C3D76C9D6AE5BB3E3471E24164F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8780285acf42af8b8e2ee941748b4a8cf2dccb66686aced036f19434c3473e6e
- MD5 b52ceb9aca7685fe100845cc63342044
- SHA1 270d2864c29b819a3a7c6aa4e32478a67934562a
- SHA512 f371572e140ffe69a8a52765052e9b757cd1a10d9cadb00f4a9945f06217b844d09a19ddd1ccbf0a379aafc755f6239fe2e2c6394f5b8f3ebeb60f9d7b964d4f
- SSDEEP 192:2RqL11ZtJMVv7sBpAPRp2Z9NH9WWb+WNnIO0+c29eEB7a7VyIsnAUgtaJ:2RqJrsl8UXerRh0D2Ta98
- TLSH T1D142E92EBA24653B6CCBD21AF9267B53E7F5102121D42D84EEFC852C15E79CD221781B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 409beec7eb26c30b19545fd69ea25db1d237b00c7a06d033e338a39cfc239156
- MD5 cb70ab7dcd6eb6a165d731a265f8350e
- SHA1 ddc9603267f6a4078d04951650468a1661571450
- SHA512 f229333d725d4fa400e57e7272f2d64f08f85667c61ad791baba50d7a79a895d8ce7c1bc795e423c28c88198df436a621186846c4dca5d22ac6ed0ddb5b0babb
- SSDEEP 192:NRqL11ZtJ7Kv7E7BhwPRpaclI9NHsb+WNnIO4Ws2mc29eEB7acVyIsnAUgraJ:NRqJrbG8oXorwhW2r2Ta4e
- TLSH T14B52F86EB92469376CDBD21AF9167B53E3F4102125D02E84EEFC8A2C15F79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 ff2cd5d7cbafa9e9d0b30bf1cd4d8394cffb94a37de0b2f66ad4488f2262e780
- MD5 50855fc1df73a890db7a0096ba1e2e82
- SHA1 5c826f5538aee199ee9db3119417d25a803a4087
- SHA512 fd6f47e88ade5b558f2823f178fa2bcb335281f4b2ccff9b69a0d2485c37b5c3e7e014cfe8612509ae3bc232aab9d2d24858a6f33a62a56299582d6cb4ddd69c
- SSDEEP 192:NRqL1ZZtJ7wv7E7BhwPRpaclI9NHsb+WNnIO4cjeIc29eEB7acVyIsnAUgraJ:NRqJXbs8oXorwh/et2Ta4e
- TLSH T1E952F82EB924693B6CDBD22AF9167B53E7F4102125D01E84EEFC8A2C15F79CD221B417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 be9a7980a1bc2f095a9f037ceec744622b552b07c783e2a7b93c40c92ae7962a
- MD5 61e3fe228833f22c2a43366fc746a5d5
- SHA1 abc530b1645b10f8d68cfef36c76db73e7ed3ae5
- SHA512 8538aa6a00e63b314e9847a158382571b17e19365b64d4bad5c66eef23f9c582494ac45a693fc115d9eba66bdd5bc750aeab950a79abd1234e4e5a5414d48082
- SSDEEP 192:NRqL11ZtJ7+rv7E7BhAPRp2clI9NHsb+WNnIO4Ws2uc29eEB7asVyIsnAUgraJ:NRqJrb+T88XcrwhW2T2TaIe
- TLSH T1EF52F92EBA24693B6CDBD21AF9167B53E7F5102121D01E84EEFC8A2C15F79CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
- MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
- SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
- SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
- SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
- TLSH T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 59c4ad62ba9f124719baa13a25b7cf5b5c45b85d998dc98221eeb9e52b50fe03
- MD5 5e0d25cea6d2b21529a9200710221583
- SHA1 401b7849726701d31e34f8fad8e09614ef65e435
- SHA512 12e26f6631034f5216e6eac3d0696f8b5504a1197dc3e6b198fc258a407ec39a58ae38399afbf4ed26d6a02c2f76810821815296fb83a5ab6992b055f8bea79b
- TLSH T148B01200C0415201C04202B0128A14C8B3587F30960B570543F0A922D82A161C1181D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587da7.TMP
- Size 96B
- SHA256 389005e748ad2f9761e1aacf6a8b5ce98e4652524a88755d2413fed151730172
- MD5 e4d0221ef2ee3f3b3ac7462838c14a78
- SHA1 0879edcb65df47df518508402d4039fafe9002a5
- SHA512 925c32d6df80102ee502202454d36d9c7637a3e35c5a799ed27245aec35c407dcb176002480ca7e91b9b6571557e50efc50992ec689122acaacd4bc84d0f185b
- TLSH T1B6B00256C2036213C19243B426A596D97160DF35C603135793F2DA6ADC29E754526AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 152B
- SHA256 d5ef413a7f8dd62f5f940abb6ca0c8e2caabdb6e33395d85d3082b6420ef5889
- MD5 34d74d60e89e6e832c0544a0368bf25f
- SHA1 dd425f78a82f22b0d29c5b35a1925e3fcf29a842
- SHA512 7c5fde4e4ca6890ecb9209442ab29e7563bf80462f02cf9d16972bd85e974b5a729f7a8cfb26054da3a78421e1b886e592cd8559165718603376aa045d33bc04
- TLSH T1DBC02BF31018688B4B70EFF41036331CD417C50C8CD4DCE4D00870A321784330402671
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 78B
- SHA256 d82dac03c5b49330ad09c959b42cb5123a3e521ddde5befc624efd966d760037
- MD5 fcb72bb63dc7fd744036aef301a3a465
- SHA1 5f18eb2cb4c968f9433b0dd9ef57bdc41f1b5f9d
- SHA512 dd1a9af69f3b5ed9aa3720dfa58b527b1f486bd2a3c67d7070567e6b4ee2abe86d1df63c6d877f5e6b7834a45412611bb725ae9d3cf8831cd6c835ca8236114f
- TLSH T14DA002FB1808848A1F70BAF82479B71DE00B828D8CE5DEF0C408B0E22179A3200039A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
- Size 159B
- SHA256 bda8abe890af8d1e2310b422afe16e28abc43445b32ab7e7e205ef0b73e3420f
- MD5 da1e0d1900d3971e74dd9218cb81b1e8
- SHA1 c77e0bd98b3babe737b9490a0c4b684aa9215d53
- SHA512 3441aa6bf23b5b6f3072fa1726c79ce608a528e301d221a7c202f16d2669d8d83e62be2db83c93bb4c4adb93613012f0a5bdded91ffce2717df9640d40e2beef
- TLSH T1A3C02BD3102819870B70A6F01036334CD427CC0C4CC8DCE4C00970B331784234801671
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58a67c.TMP
- Size 162B
- SHA256 735d76140ca053238d835cfa5f5d126b314941df90ab566ee5d05eaefa8fc3ec
- MD5 fed892487901b8c0cdcced8a1eb05d50
- SHA1 66f94c1079a96bcadab065989068f6410b26b1df
- SHA512 36042498352427b818391473906f7a46be408ddcb7d6c2a10701315c9671e8b9d093f08b49731cf061d9958d58653090a31871d9d5ffd25688e87830e85b5c9c
- TLSH T16CC08CA7453A88461BA0A6E11838761CE0036C4B4CC6CDE4E504B0D320F832680039B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 d16290414902a6b232d9ef92b546d0f374e4e2b6b910e2c516f82f519ad04800
- MD5 0336f4b073714481bbed665d65938f6f
- SHA1 0652a602b436160bffc9ce0721c27f73ef5ac206
- SHA512 accf9561289acb49ed426068d5588af5a7eb94f80419e4d2e3b5b6fb6c57b5a2e25d0e97ac043aa4fec064bbc376d08a66142cc4f176643d69f6ccc5181c290e
- SSDEEP 6144:fA/wheVD8JS1xXobgAr5Yr+Xm7Rkm1tYpBeh2BAoi:fpmD+S1xYbgmG59oBGcAoi
- TLSH T1143412767D366BBA08FAFF1AB4866F0B4EF1512391287ED1C4D4EB0853E6AD84905C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 ccaaf9f9bb3ec45382a1a8c065ed65ce91eed8a69775e3c789d3324316b295a3
- MD5 4ca239d9a7f21437759002321769f41f
- SHA1 425322246bf2a869e6e5e766980193cc29ecb64f
- SHA512 05584bec26e1f336db5db658bd4d59345ecc4887963503e2796a97e04bf026263c093ba085fc9c404d148eb2bb1d5197d166a6c7c8f0e22fe5563025b7a91373
- SSDEEP 6144:PA/wheVD8JS1xXobgAr5Yr+Xm7Rkm1tYpBeh2BAoi:PpmD+S1xYbgmG59oBGcAoi
- TLSH T1E33423667D366B7918F9FF2AB44B6F0B4EF1412781286ED2C4D4EB0857E6AD44805C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 774eea08e989dcdfdd94ac11605791347d4808a8bc3bbfb1f6396f9007196df6
- MD5 f3c4c92743a5e54ec9928201c23a93e5
- SHA1 3c67c19ef1499eeb88f74ebc5cfffc549bcf6358
- SHA512 776511b68d0dae2679f162787ff9de3aa23e923a2c34e40444e75a9577775c0a116c6574dfdb7f25dfd4af5742b201f7c4f56d42d67130603b399ae9c0e95969
- SSDEEP 6144:wA/wheVD8JS1xXobgAr5Yr+Xm7Rkm1tYpBeh2BAoi:wpmD+S1xYbgmG59oBGcAoi
- TLSH T1EF3423667D366BB918F9FF2AB44B6F0F4EF1452381286ED2C4D4EB0857E6AE44805C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 8da2a81c16b9f5b117911875ddb8347e2a5f2a1355a27bcacd8b9bd2c373fec8
- MD5 384ce82c7624e518c51c12571627bf9d
- SHA1 d140409df08a46980057515dedb7f92b278b9d8c
- SHA512 127698929b027988339f06f4544f34feddbf610247e7765e157898ab7c44673cbf76e3668b1540a77baeadce1a691be2c360d29f9bb02f81693c04d6db672773
- SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:zm7Rkm1tYpBeh2BAoe
- TLSH T190C3122B5E65A9775DB5BB0EB08E0B1F1EF14AA6C920DE82C8D85A0437E97CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 340KB
- SHA256 96bdb4c1c6cdb9507338f7d1d1a36f06174b9cc430322845db6573527a664298
- MD5 9f1bceab6003cbec510f54ed1e44c7f1
- SHA1 3757e72ad161bce67047b9a5ca52d6d13a473a4b
- SHA512 2303402798835ab23281630a6ca5893c3e1b04ea71203dd7cfc7dc2510af9f22f4f7d6f1fe02bc02c6ab690f512fd17767a0c3a83e3f67c75a89e7d609bf6853
- SSDEEP 6144:mh+GA/8VP11A/wheVD8JS1xXobgAr5Yr+Xm7Rkm1tYpBeh2BAoi:cxjV11pmD+S1xYbgmG59oBGcAoi
- TLSH T1487423767C357A3A18FEAE2A614B3E0F4FF1669389186FD0C9C09A0463AB7D45D11C70
- MD5 SHA1 SHA512 SSDEEP TLSH